Microsoft Helps Take Down Massive Automated, AI-Powered Phishing-as-a-Service Platform

Microsoft's security blog details the fight against a new AI-powered cybercrime platform offering "phishing-as-a-service." The platform, named EvilTokens, compromised over 12,000 inboxes across more than 10,000 organizations worldwide. It used AI tools to tailor phishing emails, analyze compromised inboxes to identify high-value targets, and even help craft better phishing messages by sifting through victims' mailboxes.

Microsoft collaborated with other organizations, including Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, Shadowserver Foundation, and TRM Labs, as well as the Metropolitan Police Service's cybercrime team. Together, they seized 50 sites and disabled 150 domains.

Microsoft notified affected customers, assisted in remediation, and shared intelligence to support defensive and investigative actions. On September 11, 2026, two men were arrested and digital devices were seized for examination.

EvilTokens used AI to decide who to target, impersonate, and exploit. It offered preset prompts for finding wire-transfer discussions, locating money movers, and determining the best people to impersonate. The platform combined account compromise, mailbox analysis, target selection, and fraud preparation in a single service, available for a $1,500 initiation fee and $500 recurring subscription.

EvilTokens drew on capabilities from multiple AI models, effectively packaging the fraud process into a commercially run service with subscription pricing, customer support, management dashboards, and tools for moving victims toward financial exploitation.