Microsoft seizes EvilTokens as AI drives BEC fraud
Microsoft and partners disrupted EvilTokens after the phishing service was tied to more than 12,000 compromised inboxes at over 10,000 organizations. With court authorization, the coalition seized 50 websites, disabled 150+ domains, and notified affected customers while the Metropolitan Police said two suspects were arrested separately in London on Sept. 11.
EvilTokens used Microsoft’s legitimate sign-in page to trick victims into entering an authentication code, which gave the operators a live session instead of a password. Once inside, an AI chatbot could read and sort mail for wire-transfer threads, invoices, trusted contacts, and likely impersonation targets, which cut the time between mailbox access and fraud.
The lasting exposure is the mailbox session, not the lure that started it. In organizations that approve payment or bank-detail changes over email, a compromise can keep feeding payment-fraud work even after a password reset if sessions and tokens are still live.