Microsoft Takes Down EvilTokens Device-Code Phishing Service

…in connection with the illicit commercial operation. The tech giant described EvilTokens as a "powerful cybercrime platform" that used AI to compromise email accounts and design roadmaps for financial fraud and scams. " While EvilTokens helped cybercriminals access email accounts, at the center of the service was an AI-style chatbot that could analyze a victim's inbox and help criminals identify trusted relationships, payment authorizations, and sensitive responsibilities, as well as other circumstances where fraud was most likely to succeed, " Steven Masada, associate general counsel and general manager at Microsoft's Digital Crimes Unit, said. "The platform could even recommend fraud strategies, including drafting messages that impersonated trusted…

…data that included 8,708 unique victim accounts compromised by EvilTokens. These accounts span 6,585 unique corporate email domains located across 79 countries. The earliest captures date back to February 18, 2026. " EvilTokens used AI to make the hard parts easy: reading compromised mailboxes in more than twenty languages to find the conversations worth hijacking, and drafting the impersonation mail that follows ," Trevor Hilligoss, SpyCloud's Chief Investigations Officer, said in a statement. "Those were the parts of business email compromise that used to require human involvement, and that scaled with the skill of the…