Microsoft disrupts EvilTokens, seizes 50 websites

Microsoft's disruption of EvilTokens, announced Tuesday, followed a few-month span in which the platform compromised 12,000 Microsoft accounts belonging to 10,000 organizations worldwide, with the highest concentration in the US. The platform was introduced over a Telegram channel in February and charged an initial $1,500 fee plus a recurring $500 monthly charge, offering a single service that streamlined most steps required to compromise email accounts in large numbers.

At the center of EvilTokens was an AI-style chatbot that could analyze a victim's inbox, help criminals identify trusted relationships and payment authorizations, and even recommend fraud strategies, including drafting messages that impersonated trusted contacts. The platform also helped customers select targets for the biggest potential payouts and draft follow-up emails with realistic ruses to trick company employees into transferring funds to attacker-controlled accounts. Victim organizations spanned wholesale distribution, construction, financial services, real estate, higher education, and healthcare.

The operation, which involved a legal process and a network of partners, resulted in the seizure of 50 websites and 150 more domains, and the UK's Metropolitan Police Service arrested two men on suspicion of offenses allegedly connected to the crime platform. The outcome hinges on whether these seizures and arrests disrupt the platform's subscription model and Telegram distribution enough to deter similar services, and on how quickly affected organizations in the listed sectors can review their email authentication and fraud controls, which is likely to be a priority given the use of legitimate OAuth device code authentication in the compromises.