Microsoft takes down ‘EvilTokens’ hacker service that used AI to ‘decide who to target, who to impersonate, and how to most effectively exploit’ victims
In just six months, the EvilTokens phishing as a service platform hit thousands of organizations worldwide
Microsoft has disrupted the EvilTokens cyber crime platform in a coordinated campaign that saw 50 websites seized and two men arrested in the UK.
The EvilTokens phishing as a service (PhaaS) platform emerged in February on Telegram, giving cyber criminals AI the ability to tailor phishing lures and analyze compromised inboxes to identify high-value targets.
In the short time it’s been up and running, the platform has been used to compromise more than 12,000 inboxes at more than 10,000 organizations.
Campaigns have targeted various industries, including wholesale distribution, construction, financial services, real estate, higher education, and healthcare, with most activity in the US, Canada, the UK, Australia, India, and France.
Customers paid a $1,500 fee up front to use the service, with a recurring $500 subscription for continued access to the kit and control panel.
This kit offered further products, including Antibot redirector, B2B Sender, Office 365 Capture Link, and a Simple Mail Transfer Protocol (SMTP) Sender, each of which carried additional monthly fees.
What hackers got with EvilTokens
Subscribers were offered personalized lures, with AI used to create targeted phishing emails that were specifically aligned to the target’s role.
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
According to Microsoft, themes used to increase the chances of a response included document signing services, its own cloud services, third-party services such as cloud identity, file hosting and payment or invoicing, as well as other miscellaneous services like voicemail and eFax.
Notably, the service was centered around an AI-style chatbot that could analyze a victim’s inbox and help criminals identify trusted relationships, payment authorizations, and sensitive responsibilities, as well as other situations where fraud was most likely to succeed.
It could even recommend strategies for carrying out fraud, including drafting messages that impersonated trusted contacts to help criminals trick their victims into taking action.
"AI was not simply helping attackers write more convincing messages. It helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible," said Steven Masada, associate general counsel and general manager at Microsoft’s Digital Crimes Unit.
How Microsoft tackled EvilTokens
Microsoft, with authorization from the US District Court for the Eastern District of Virginia and the help of several other companies, has now seized 50 websites used to operate the service.
More than 150 other domains tied to its supporting infrastructure have also been seized.
"While EvilTokens used AI to identify targets and prioritize fraud opportunities, Microsoft investigators used reverse engineering and AI-powered tools to analyze evidence, accelerate the investigation, and identify the infrastructure supporting the service," Masada said.
Cloudflare, meanwhile, was able to identify the complete list of domain infrastructure and hundreds of Cloudflare accounts used by EvilTokens’ customers.
It carried out a technical sweep, blocking hundreds of domains and killing malicious Cloudflare Worker scripts. Where infrastructure couldn't be legally seized, it made use of interstitial warning pages.
As a result of the operation, the UK Metropolitan Police Service’s cyber crime team has now arrested two men, aged 32 and 38, suspected of being involved.
Authorities also seized digital devices and other items for examination. Both men have been released on police bail while the investigation continues.
FOLLOW US ON SOCIAL MEDIA
Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.
You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
Building solid cybersecurity foundations for the AI eraWith cyber risks evolving, it's never been more important to consider embedding security-by-design into the core of your infrastructure
-
How Dr Martens is working with Salesforce to create ‘agentic experiences’ for customersCase Study Customer satisfaction at Dr Martens was slipping, but agents are helping turn things around as part of a sweeping digital transformation with Salesforce.
-
Cyber criminals are adapting ASCII smuggling for mass phishing campaignsNews Usually known for its use in prompt injection attacks, ASCII smuggling is now being used to evade spam filters on email platforms
-
Delta Airlines flight Wi-Fi tampered with after DEF CON conferenceNews A rogue network named 'Delta WiFi Fast' was created in an apparent in-flight phishing attack
-
Microsoft forks out record-breaking sums with expanded bug bounty programNews Hundreds of security researchers won a share of $20 million after the tech giant expanded its bug hunting scheme
-
'It delivers world-class performance at 50 percent of the cost of leading models': Microsoft unveils cut-price AI for security with latest in-house model launchNews Pairing the MAI security model with GPT-5.4 gives benchmark leading results at half the cost, according to the tech giant
-
NCSC issues alert over 'zero-click' phishing campaign hitting enterprisesNews Ukrainian organizations were used to test new zero-click techniques employed by Russian hackers
-
Why Microsoft paused Patch Tuesday updates for some Dell devicesNews Select devices running Intel Innovation Platform Framework drivers encountered “poor performance”
-
Passkeys will soon be the default authentication method in Microsoft Entra ID – here's what it means for users and when the changes come into effectNews The shift to passkeys for Microsoft Entra ID comes amidst growing concerns over AI-powered phishing and identity theft
-
Multi-channel phishing attacks: How to manage the riskIn-depth Attackers are evolving beyond email towards phishing across multiple channels. Why is this, and what can be done to manage the risk?