Microsoft disrupts AI-assisted platform that compromised 12,000 accounts

Microsoft disrupted a subscription-based scam platform called EvilTokens that used an AI chatbot to compromise 12,000 accounts belonging to organizations worldwide. The platform streamlined account compromise by automating spam campaigns, analyzing victim inboxes to identify payment authorization patterns, and drafting convincing fraud messages, which reduced what normally takes attackers days of manual work to minutes. EvilTokens exploited a legitimate authentication process designed for devices like televisions by tricking users into entering device codes that allowed attackers to enroll their own devices and gain account access. Microsoft, working with partners and law enforcement, seized websites and domains operating the platform and authorities arrested two men in connection with the operation.