Microsoft disrupts AI-assisted platform that compromised 12,000 accounts
Summary
Microsoft disrupted EvilTokens, a Telegram-based, subscription service that used an AI chatbot to automate mass credential compromises of 12,000 Microsoft accounts across thousands of organizations. The platform facilitated target selection, crafting convincing phishing emails, and post-compromise actions, leveraging device-code authentication to enroll attacker-controlled devices; authorities seized domains and arrested two suspects in the UK. The report highlights how AI-driven tooling accelerates cybercrime and stresses the importance of strong identity protections and independent verification of payment-change requests.