EvilTokens was the first AI-enabled cybercrime service
Assessment
Microsoft's precise wording is that the disruption was the Digital Crimes Unit's 'first action against an end-to-end AI-enabled cybercrime service' — a statement about Microsoft's own enforcement history, not a claim that EvilTokens is the first AI-enabled criminal service to exist. The shorter paraphrase that circulated, 'the first AI-enabled cybercrime service,' drops the qualifier and asserts a primacy Microsoft did not claim; other AI-assisted criminal tooling predates this takedown. The accurate reading is 'Microsoft's first takedown of one,' which is a milestone in enforcement rather than a first-of-its-kind in the wild.
Where this claim appeared
Microsoft · 2026-09-22
https://blogs.microsoft.com/on-the-issues/2026/09/22/disrupting-eviltokens-the-ai-chatbot-built-for-cybercrime/What “Assessed, Not Confirmed” means
A named source states this as its own assessment, at its own stated confidence, rather than as established fact. Attribution to a nation state usually sits here. The assessment is real and reportable; treating it as settled is the error.
4 of 5 · rating scale
Assessed in
EvilTokens: Microsoft's DCU dismantles an AI-chatbot phishing service that hit 12,000 inboxesThink this assessment is wrong? Report an error.