Microsoft disrupts AI-assisted platform that compromised 12,000 accounts

Microsoft led an industry-wide disruption of EvilTokens, a subscription-based cybercrime service promoted via Telegram that used an AI-style chatbot to analyze victim inboxes and help criminals identify high-value targets, craft convincing phishing messages, and carry out account takeovers and fraud. The platform reportedly compromised 12,000 Microsoft accounts across 10,000 organizations globally, abused OAuth device-code authentication for access, charged subscription fees, and was disrupted through domain seizures and law enforcement arrests.