Microsoft says it used court action and police cooperation to take down EvilTokens, an AI-powered cybercrime service that automated the search for profitable targets inside stolen inboxes. Two men were arrested in the UK, according to The Record, although both have been released on bail and the investigation continues.
Microsoft AI Watch analysis
What happened
The Record, citing Microsoft and the Metropolitan Police Service, reports that EvilTokens charged $1,500 to join and $500 a month for access. Microsoft says the service was linked to more than 12,000 compromised email inboxes across over 10,000 organisations worldwide.
Microsoft says it worked with Health-ISAC in a US lawsuit that enabled the seizure of 50 websites used to run the service, while a further 150 domains connected to its infrastructure were disabled. The company also worked with Cloudflare, Coinbase, the Shadowserver Foundation and TRM Labs.
The service did more than generate plausible phishing emails. According to Microsoft, its tools could summarise and translate inboxes, map organisational roles, locate financial conversations and vendor invoices, identify trusted relationships and recommend the people most useful to impersonate. It offered pre-built phishing templates and landing pages, alongside an AI assistant for tailoring attacks.
The platform also used device-code phishing, a method that can trick people into authorising an attacker’s session without handing over a password. Microsoft says access could persist even after a victim changed their password. The company described EvilTokens as largely “vibe coded”, meaning built substantially with large language models.
Why it matters
The practical shift is scale and speed. Microsoft says criminals once needed days or weeks to inspect a breached inbox and work out how to exploit it. EvilTokens could automate much of that process within minutes, turning a pile of stolen correspondence into a map of who pays whom and which trusted colleague to imitate.
That matters to accounts-payable teams, executives and anyone handling sign-in prompts. A convincing invoice email is no longer necessarily an isolated lure. It may be part of a wider, machine-assisted campaign that has already studied the victim’s relationships and responsibilities. Apparently the inbox has joined the criminal supply chain, and it did not ask for the promotion.
The case also shows why “AI-enabled” needs careful definition. Microsoft says EvilTokens drew on multiple AI models, but it declined to identify all of them. The Record reports the service’s capabilities and the takedown, not an independent technical audit of every model involved.
Our read
This is a serious security development because the automation was aimed at decisions, not just prose. The worrying feature is not that a model can write a better scam email. It is that a service can help decide whom to target, which relationship to counterfeit and when a payment request is most likely to work.
Organisations should treat a request involving a familiar person, supplier or invoice as a connected social-engineering risk, particularly when it arrives alongside a sign-in prompt or device-code instruction. Verify payment changes through a separate channel, do not approve unexpected authentication codes and make sure incident teams know that changing a password may not end an already-authorised session.
Microsoft’s court-authorised disruption is significant, but takedowns are not the same as eradication. The infrastructure, operators and underlying techniques may reappear under a different name, with another set of models doing the paperwork.
What to watch
- Replacement services:
whether similar platforms appear with new branding, domains or payment routes. - Account persistence:
whether organisations tighten controls around device-code authentication and existing sessions. - Model involvement:
whether Microsoft identifies the AI services used or publishes more technical evidence. - Legal outcome:
whether the UK investigation produces charges or further arrests. The evidence supports Microsoft’s account of the takedown, the police arrests and the reported capabilities, but the allegations against the two arrested men remain subject to the ongoing investigation.
Discussion spark: Should organisations focus more on blocking AI tools used by attackers, or on redesigning email and payment processes so that better-targeted scams fail anyway?
Sources and evidence
not affiliated with or endorsed by Microsoft