Microsoft disrupts AI-assisted platform that compromised 12,000 accounts

How AI Is Reshaping Cybercrime Tactics

Microsoft has taken down an AI-powered cybercrime platform called EvilTokens that enabled attackers to compromise over 12,000 accounts through automated credential theft and phishing campaigns. The disruption occurred in September 2026 after Microsoft’s Digital Crimes Unit identified the service as a major enabler of large-scale account takeovers targeting enterprise and consumer users globally. EvilTokens operated as a subscription-based toolkit that lowered the technical barrier for criminals to launch sophisticated attacks at scale.

The platform integrated artificial intelligence to generate convincing phishing lures, automate bypasses of multi-factor authentication, and manage stolen credentials in real time. Subscribers gained access to pre-built templates mimicking legitimate services, reducing the effort needed to deceive victims. Microsoft’s investigation revealed that EvilTokens had been active for approximately eight months before detection, with its infrastructure hosted across multiple jurisdictions to evade takedown efforts. The company worked with international law enforcement and internet service providers to seize domains and disrupt command-and-control servers.

What Measures Can Organizations Take Now?

EvilTokens exemplified a growing trend where attackers use generative AI to personalize scams at unprecedented volume and speed. By analyzing public data, the AI could tailor messages to specific individuals or organizations, increasing success rates beyond traditional spam tactics. Security experts noted that the platform’s ability to adapt phishing content in response to user behavior made detection more difficult for standard email filters. Microsoft emphasized that while AI enhances defensive capabilities, it also empowers malicious actors when misused, necessitating continuous innovation in threat intelligence.

Organizations are advised to implement phishing-resistant multi-factor authentication, conduct regular employee training on social engineering risks, and monitor for anomalous login patterns. Microsoft recommends leveraging AI-driven threat detection tools that can identify subtle indicators of compromise missed by rule-based systems. The company also urges users to report suspicious communications through official channels to aid in early threat identification. Proactive defense, combined with rapid incident response, remains critical in countering evolving AI-assisted attacks.

What was EvilTokens and how did it work? EvilTokens was a subscription-based cybercrime platform that used artificial intelligence to automate phishing attacks, bypass security measures, and manage stolen credentials, allowing users to launch mass account compromises with minimal technical expertise.

Frequently Asked Questions

How many accounts were affected by EvilTokens? The platform was linked to the compromise of over 12,000 accounts before Microsoft disrupted its operations in September 2026, based on telemetry and victim reporting analyzed during the investigation.

What steps is Microsoft taking to prevent similar threats? Microsoft continues to enhance its security infrastructure with AI-powered threat detection, collaborates with global partners to dismantle cybercriminal infrastructure, and provides guidance to help users and organizations defend against evolving attack methods.