EvilTokens: AI scam platform drops inbox analysis to minutes

According to Ars Technica, Microsoft recently dismantled EvilTokens, a subscription-based cybercrime platform that leveraged artificial intelligence to compromise 12,000 accounts across 10,000 organizations. Operating via Telegram with a $1,500 initial fee and $500 monthly subscriptions, the tool automated the most complex phases of business email compromise.

How did the EvilTokens AI platform operate?

The platform utilized a backend chatbot to analyze batches of 5,000 compromised emails at once. Instead of requiring human operators to manually map out corporate hierarchies, the AI identified employees authorized to release funds, pinpointed key managers, and drafted realistic phishing lures. This reduced the time needed to profile a target from days to minutes.

Furthermore, the service abused legitimate OAuth mechanisms—specifically device code flows designed for input-constrained hardware like smart TVs. By generating scripts that interacted with Microsoft Entra in real time, attackers bypassed traditional signature-based security detections while tricking users into authorizing rogue devices.

What does this mean for corporate security on Monday morning?

Microsoft noted that the primary takeaway for organizations is speed: once an inbox falls, automated tools can map vulnerabilities almost instantly. Security teams can no longer rely solely on perimeter defenses to catch slow, manual reconnaissance. Critical financial transactions and requests for fund transfers must be independently verified through a secondary channel, regardless of how convincing an internal email appears.