{
  "id": 9290907,
  "title": "Microsoft Helps Take Down Massive Automated, AI-Powered Phishing-as-a-Service Platform",
  "url": "https://urgent.news/2026/09/23/microsoft-helps-take-down-massive-automated-ai-powered-phishing-as-a",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-23T07:04:00.000Z",
  "source": {
    "name": "Slashdot",
    "slug": "slashdot",
    "url": "https://yro.slashdot.org/story/26/09/23/0621252/microsoft-helps-take-down-massive-automated-ai-powered-phishing-as-a-service-platform"
  },
  "original_language": "en",
  "account": "Microsoft's security blog details the fight against a new AI-powered cybercrime platform offering \"phishing-as-a-service.\" The platform, named EvilTokens, compromised over 12,000 inboxes across more than 10,000 organizations worldwide. It used AI tools to tailor phishing emails, analyze compromised inboxes to identify high-value targets, and even help craft better phishing messages by sifting through victims' mailboxes.\n\nMicrosoft collaborated with other organizations, including Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, Shadowserver Foundation, and TRM Labs, as well as the Metropolitan Police Service's cybercrime team. Together, they seized 50 sites and disabled 150 domains.\n\nMicrosoft notified affected customers, assisted in remediation, and shared intelligence to support defensive and investigative actions. On September 11, 2026, two men were arrested and digital devices were seized for examination.\n\nEvilTokens used AI to decide who to target, impersonate, and exploit. It offered preset prompts for finding wire-transfer discussions, locating money movers, and determining the best people to impersonate. The platform combined account compromise, mailbox analysis, target selection, and fraud preparation in a single service, available for a $1,500 initiation fee and $500 recurring subscription.\n\nEvilTokens drew on capabilities from multiple AI models, effectively packaging the fraud process into a commercially run service with subscription pricing, customer support, management dashboards, and tools for moving victims toward financial exploitation.",
  "summary": "Microsoft's security blog describes the fight against a new \"AI-powered cybercrime platform\" offering phishing-as-a-service, with AI-tailored lures and analyses of compromised inboxes (to identify high-value targets). The site compromised more than 12,000 inboxes in over 10,000 organizations around the world, compromising business accounts \"at scale\" with automated attacks and prebuilt phishing…",
  "key_points": [
    "EvilTokens AI-powered phishing platform compromised 12,000+ inboxes across 10,000+ organizations",
    "Two arrests made on September 11, 2026, with digital devices seized for examination"
  ],
  "editors_take": "The takedown of EvilTokens shows that collaboration between tech companies and law enforcement can effectively disrupt sophisticated AI-powered cybercrime operations that automate phishing and fraud.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}