Microsoft has said that it has thwarted an effort to shut down a subscription-based scam platform that relied on an AI chatbot to break into more than 12,000 Microsoft accounts over the course of a few months. The platform, called EvilTokens, first surfaced on a Telegram channel back in February, charging users an initial fee of $1,500 followed by a recurring monthly charge of $500. EvilTokens essentially offered a one-stop service that streamlined nearly every step needed to compromise email accounts at scale. According to the company, once inside, the platform helped its customers sift through victims’ inboxes, identify the most targets and even draft follow-up emails designed to trick employees into transferring funds into accounts controlled by the attackers.“In short, AI was not simply helping attackers write more convincing messages. It helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible,” the company said.
Targets in several countries, including India
Microsoft says that while it also attacked specific countries, its significance extends beyond its rapid growth and global reach.“Microsoft observed the highest concentrations of victim activity in the United States, Canada, the United Kingdom, Australia, India, and France. Affected organizations ranged from wholesale distribution and construction to financial services, real estate, higher education, and healthcare. Working with partners, Microsoft seized 50 websites used to operate the service and disabled more than 150 additional domains tied to its supporting infrastructure. In the United Kingdom, the Metropolitan Police Service’s cybercrime team arrested two men on suspicion of offenses connected with the alleged operation of EvilTokens,” the company said.
How the scam actually worked
According to Microsoft, what set EvilTokens apart was the AI-style chatbot sitting at the heart of the operation. The chatbot could analyse a victim’s inbox and help criminals pinpoint trusted relationships, payment approval authority, sensitive job responsibilities and other circumstances where fraud was most likely to succeed. It could even go a step further, recommending specific fraud strategies and drafting messages impersonating trusted contacts to manipulate victims into taking action.The account compromises were carried out through a legitimate OAuth authentication process known as device code authentication. This method was originally designed for devices like smart TVs, essentially anything lacking a standard login interface. In this setup, the device being signed into displays a code, and the user is instructed to enter that code into a browser on a separate device, which then gets authenticated.EvilTokens gave its customers a platform capable of automating the mass sending of spam emails. Anyone who clicked on a malicious link or attachment inside these emails would be redirected to a webpage running a hidden automation script, which interacted in real time with the victim’s Microsoft identity provider to generate a device code that would enrol a device belonging to the attacker.The victim would then see this device code onscreen, along with instructions telling them to copy it and enter it into Microsoft’s official device login portal. Behind the scenes, complex backend operations allowed the hackers slip past traditional signature- or pattern-based security detection systems. This technique powered the entire attack chain, from generating dynamic device codes all the way through to actions taken after an account was compromised.Microsoft said EvilTokens marks a significant shift in how mass account compromises, and everything that follows them, now unfold.
