EvilTokens: Microsoft's DCU dismantles an AI-chatbot phishing service that hit 12,000 inboxes

Executive Summary

On September 22, 2026, Microsoft's Digital Crimes Unit (DCU) announced a court-authorized disruption of EvilTokens, a cybercrime-as-a-service platform that paired ordinary account-takeover phishing with an AI chatbot built to read a victim's stolen inbox and pick the best fraud targets from it.¹² Acting on an order from the U.S. District Court for the Eastern District of Virginia, Microsoft and its partners seized 50 websites used to run the service and took down more than 150 supporting domains.¹² Microsoft called it the DCU's first action against an "end-to-end AI-enabled cybercrime service," and its 40th court-authorized disruption in roughly two decades.¹

The technical core of EvilTokens was two-part. The compromise itself was not novel: the service used device-code phishing, tricking victims into entering an authentication code on Microsoft's own legitimate sign-in page, which handed the criminals access to the mailbox without ever exposing the victim's password.¹ What was newer was what came next. Once inside an account, EvilTokens' AI-style chatbot could "summarize and translate emails, surface financial conversations, map organizational roles, identify trusted relationships, and recommend potential targets."¹ Preset prompts located wire-transfer discussions, flagged "money movers," and picked out who to impersonate — automating the reconnaissance that a business-email-compromise (BEC) fraudster would otherwise do by hand.¹ This is the distinction worth holding onto: the AI did not do the hacking; it industrialised the targeting that turns a compromised inbox into a fraudulent wire.

The scale was broad. Microsoft counted more than 12,000 compromised email inboxes across over 10,000 organizations, concentrated in the United States, Canada, the United Kingdom, Australia, India and France, and spanning wholesale distribution, construction, financial services, real estate, higher education and healthcare.¹ The service launched in February 2026 and ran for months before the September takedown, sold through Telegram on a subscription model — a $1,500 initiation fee and a recurring $500 monthly charge.¹

The disruption was a coordinated civil-and-criminal effort, not a Microsoft-only takedown. Microsoft and Health-ISAC worked with Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation and TRM Labs to dismantle the infrastructure, while separately, on September 11, 2026, the UK Metropolitan Police arrested two men, aged 32 and 38, on suspicion of offences tied to running the service.¹³ Keeping those two actions distinct matters: Microsoft's court order seized infrastructure; the arrests were a police operation. Neither Microsoft nor the courts arrested anyone, and the two arrested men were not publicly named.

Verification of Claims

1. Claim: Microsoft's DCU disrupted EvilTokens, seizing 50 websites and 150+ supporting domains under a court order. → Verified (per Microsoft) → Microsoft's DCU announced the action on September 22, 2026, describing an order from the U.S. District Court for the Eastern District of Virginia and the seizure of 50 websites plus more than 150 supporting domains.¹

2. Claim: EvilTokens was an AI-powered phishing service. → Assessed — with an important nuance → The label is Microsoft's own, and accurate in that the platform integrated an AI chatbot as a core feature. But the AI's role was analysing already-compromised inboxes to select BEC targets, not conducting the phishing: the account takeover itself used conventional device-code phishing. "AI-powered phishing" is fair shorthand for the product; read literally as "AI carried out the attacks" it overstates what the AI did.¹²

3. Claim: EvilTokens compromised 12,000+ inboxes across 10,000+ organizations. → Verified (per Microsoft) → Microsoft's figures are more than 12,000 compromised inboxes across over 10,000 organizations, concentrated in the US, Canada, UK, Australia, India and France. These are Microsoft's counts, disclosed with the takedown.¹

4. Claim: This was "the first AI-enabled cybercrime service." → Assessed, not confirmed → Microsoft's precise phrasing is that this was the DCU's first action against an "end-to-end AI-enabled cybercrime service" — a statement about Microsoft's enforcement history, not a claim that EvilTokens is the first such service to exist. The stronger paraphrase ("the first AI-enabled cybercrime service") drops the qualifier and asserts a primacy Microsoft did not.¹

Timeline

Operation Anatomy

The criminal service (what was taken down)

Access — device-code phishing. EvilTokens tricked victims into entering an authentication code on Microsoft's legitimate sign-in page, granting mailbox access without exposing the password (T1566.002), and yielding usable OAuth access tokens (T1528).¹

Persistence and reading — token-based mailbox access. With the token, criminals read the mailbox as the user (T1550.001), and the AI chatbot performed remote email collection and analysis — summarising, translating, mapping roles and surfacing financial conversations (T1114.002).¹

Monetisation — BEC and fraud. Preset prompts identified wire-transfer discussions, "money movers" and impersonation targets, priming business-email-compromise fraud against the victim's contacts (T1657).¹

The disruption (what Microsoft and police did)

Microsoft's DCU obtained an E.D. Va. court order and, with Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation and TRM Labs, seized 50 websites and 150+ supporting domains; separately, the UK Metropolitan Police arrested two men on September 11, 2026.¹³

Threat Actor Profile

• Operators: Unattributed. The people who ran EvilTokens are not publicly named; the UK Metropolitan Police arrested two men, aged 32 and 38, on September 11, 2026, on suspicion of offences related to the service's technical infrastructure.¹³ Arrest is not conviction, and no names have been released.
• Business model: Cybercrime-as-a-service. EvilTokens was sold to other criminals as a subscription — a $1,500 initiation fee and $500 monthly — through Telegram, lowering the skill required to run inbox-compromise-to-BEC fraud at scale.¹
• Objective: Financial fraud via business email compromise. The platform's whole design — device-code phishing for access, AI analysis for targeting — points at converting mailbox access into fraudulent payments.¹
• What is genuinely new: Not the phishing, which is conventional, but the productisation of an LLM chatbot as the reconnaissance-and-targeting layer of a criminal service — the reason Microsoft frames this as its first end-to-end AI-enabled takedown.¹²

MITRE ATT&CK techniques (verified on attack.mitre.org):

Technical Indicators

platform:
  name: "EvilTokens"
  type: "cybercrime-as-a-service (device-code phishing + AI inbox-analysis chatbot)"
  active: "February 2026 - September 2026"
  pricing: "$1,500 initiation fee + $500/month, sold via Telegram"
scale:
  inboxes_compromised: "12,000+"
  organizations: "10,000+"
  countries: ["United States", "Canada", "United Kingdom", "Australia", "India", "France"]
  sectors: ["wholesale distribution", "construction", "financial services", "real estate", "higher education", "healthcare"]
takedown:
  court: "U.S. District Court, Eastern District of Virginia"
  seized: "50 websites; 150+ supporting domains"
  led_by: "Microsoft Digital Crimes Unit + Health-ISAC"
  partners: ["Cloudflare", "Coinbase", "OpenAI", "Railway", "SpyCloud", "The Shadowserver Foundation", "TRM Labs"]
  arrests: "UK Metropolitan Police, two men (32, 38), 2026-09-11"
network_iocs: "Specific seized domains were not enumerated in the announcements reviewed; the operative technique to hunt is device-code phishing (unexpected device-code sign-in prompts) and anomalous OAuth token grants, not a static domain list."

Legal and Regulatory Response

The action was civil in form and criminal in parallel. Microsoft's DCU used a civil court order from the Eastern District of Virginia to seize the service's web infrastructure — the same playbook the unit has used across 40 disruptions in roughly 20 years — while the UK Metropolitan Police pursued the criminal side, arresting two men on September 11, 2026.¹³ The private-sector coalition (Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, Shadowserver, TRM Labs) is characteristic of these takedowns: infrastructure, payment-rail and threat-intelligence providers acting together to make the service inoperable rather than waiting on prosecution alone. Notably, OpenAI's participation signals AI providers being pulled into the enforcement response as the abuse of LLM tooling by criminal services becomes a takedown target in its own right.¹

Impact Assessment

• Confirmed (per Microsoft): EvilTokens, a device-code-phishing plus AI-inbox-analysis cybercrime service active February–September 2026, compromised 12,000+ inboxes across 10,000+ organizations in six countries before Microsoft's DCU seized 50 websites and 150+ domains under an E.D. Va. order.¹
• Confirmed: The UK Metropolitan Police arrested two men (32 and 38) on September 11, 2026; they were not publicly named, and arrest is not conviction.¹³
• Assessed: The "AI-powered" and "first AI-enabled" framings are Microsoft's, accurate to the product but easy to over-read — the AI did targeting and analysis, not the intrusion, and Microsoft claimed a first action, not a first-of-its-kind service.¹²
• Unknown: The financial losses to victims; the identities and roles of the arrested men; whether the takedown fully ended the service or displaced it; and the specific seized domains.¹

Lessons and Defensive Recommendations

For enterprises on Microsoft 365 (and any OAuth-based mail):

• Device-code phishing is the access technique here, and it defeats password strength and even some MFA prompts because the victim authenticates on the real Microsoft page. Restrict the device-code authentication flow with Conditional Access — block it where it is not needed, and alert on device-code sign-ins from unexpected locations or for users who never use device-code login. This is the single control that most directly counters the EvilTokens access method.
• Hunt for the token, not just the login. Because compromise yields an OAuth access token, defenders should monitor for anomalous token grants, unfamiliar OAuth application consents, and mailbox access that does not correspond to an interactive sign-in — the signals that a mailbox is being read by a token rather than its owner.

For finance and AP teams:

• The AI layer exists to find your wire-transfer conversations and impersonation targets faster. Out-of-band verification of payment changes and new payees — a call to a known number, not a reply to the email — remains the control that stops BEC after an inbox is already compromised. Assume the attacker has read the thread and knows exactly who to imitate.

For readers:

• Hold the "AI-powered" story in proportion. The genuinely new thing is a criminal service that bundles an LLM chatbot for reconnaissance and targeting; the phishing that gets the access is conventional. And keep the two enforcement actions separate — Microsoft's court order seized infrastructure, the Metropolitan Police made the arrests; "Microsoft arrested the hackers" is not what happened.

Sources