Microsoft disrupts EvilTokens, an AI-driven e-mail fraud kit with victims in Canada
Microsoft said Sept. 22 that it had disrupted EvilTokens, a phishing-as-a-service platform that used AI to read compromised inboxes and plan payment fraud, and that Canada was among the six countries with the most victim activity.
Since launching in February 2026, EvilTokens was linked to more than 12,000 compromised inboxes at over 10,000 organizations, Microsoft said. Wholesale distribution, construction, financial services, real estate, higher education and health care were among the sectors hit. The other high-activity countries were the U.S., Britain, Australia, India and France.
How it worked
EvilTokens abused the OAuth device code flow, a legitimate sign-in method for devices without keyboards. Victims received a lure, often about an invoice, request for proposals, shared document, voicemail or password expiry, and were persuaded to type a code into Microsoft's real login page. That approved the attacker's session without revealing a password, and access could survive a password reset if sessions and tokens were not revoked, according to Microsoft Threat Intelligence.
Once inside, a built-in AI chatbot summarized and translated e-mail, surfaced conversations about wire transfers, mapped who the organization's "money movers" were, identified trusted relationships and drafted messages impersonating them. Attackers also created inbox rules to hide replies. The kit sold on Telegram for a US$1,500 initiation fee plus US$500 a month.
The disruption
With a court order from the Eastern District of Virginia, Microsoft and co-plaintiff Health-ISAC seized 50 websites and disabled more than 150 other domains. Partners included Cloudflare, Coinbase, OpenAI and SpyCloud. London's Metropolitan Police arrested two men, aged 32 and 38, on Sept. 11; both were released on bail. Microsoft called it the first disruption of an end-to-end AI-enabled cybercrime service.
What to do
- Block device code sign-in in Microsoft Entra conditional access unless you need it, and limit any exception to specific accounts.
- Tell staff never to enter a code on a Microsoft login page because an e-mail or caller asked them to.
- After a suspected compromise, revoke sessions and refresh tokens, not just the password, and check for new inbox rules.
- Require phishing-resistant MFA and verify every payment change through a second, trusted channel.
