Microsoft dismantled EvilTokens, an AI-enabled cybercrime service tied to 12,000+ compromised e-mail inboxes
EvilTokens, a cybercrime service sold through Telegram, used an AI chatbot to analyze stolen inboxes. It identified payment staff and drafted impersonation messages for business e-mail compromise fraud. Microsoft says the service was tied to more than 12,000 compromised inboxes across over 10,000 organizations worldwide since launching in February. Microsoft and Health-ISAC filed a civil lawsuit in the Eastern District of Virginia, and the court authorized domain takedowns; more than 150 supporting domains were disabled. UK police arrested two men in connection with the alleged operation.
Happened February 2026 · Disclosed September 28, 2026
- Compromised inboxes
- More than 12,000
Who is exposed
Organizations using Microsoft 365 e-mail were exposed, particularly in financial services, healthcare, construction, real estate, wholesale distribution and higher education. Staff who handle payments and wire transfers were targeted for impersonation fraud.
What to do
Train users to reject unexpected device-code sign-in prompts and consider restricting the device code authentication flow. After a suspected compromise, revoke OAuth tokens and active sessions rather than relying on password resets alone. Verify payment-change requests out of band.
Rules it touches
The civil complaint alleges violations of the Computer Fraud and Abuse Act, the Electronic Communications Privacy Act, the Lanham Act and federal racketeering law. The operators also allegedly made improper use of AI services from Groq and OpenAI.
Harm, as stated in the sources
- Compromised inboxesMore than 12,000
“more than 12,000 compromised inboxes”
AI Platform Behind 12 , 000 E - mail Breaches Dismantled -- THE Journal
Who was involved
As named in the sources. Parties are alleged unless a source reports a finding or an admission.
- Victim sectorsFinancial services, healthcare, construction and others
“financial services, healthcare, construction”
AI Platform Behind 12 , 000 E - mail Breaches Dismantled -- THE Journal - Organizations affectedOver 10,000 worldwide
“10,000 organizations worldwide”
AI Platform Behind 12 , 000 E - mail Breaches Dismantled -- THE Journal - Arrests in UKTwo men arrested on Sept. 11
“arrested two men on Sept. 11”
AI Platform Behind 12 , 000 E - mail Breaches Dismantled -- THE Journal - AI-enabled cybercrime serviceEvilTokens
“Microsoft has shut down EvilTokens, a cybercrime service that used AI to help”
AI Platform Behind 12 , 000 E - mail Breaches Dismantled -- THE Journal - AI models allegedly misusedGroq and OpenAI services
“improperly integrated services from Groq and OpenAI”
AI Platform Behind 12 , 000 E - mail Breaches Dismantled -- THE Journal
Other facts
- Service launchFebruary
“Since launching in February”
AI Platform Behind 12 , 000 E - mail Breaches Dismantled -- THE Journal - Lawsuit filedCivil suit by Microsoft and Health-ISAC
“Microsoft and Health-ISAC filed a civil lawsuit in the U.S.”
AI Platform Behind 12 , 000 E - mail Breaches Dismantled -- THE Journal - Court venueEastern District of Virginia
“Eastern District of Virginia”
AI Platform Behind 12 , 000 E - mail Breaches Dismantled -- THE Journal - Domains disabledMore than 150
“disabled more than 150”
AI Platform Behind 12 , 000 E - mail Breaches Dismantled -- THE Journal - Subscription price$500 per month
“$500 monthly subscription”
AI Platform Behind 12 , 000 E - mail Breaches Dismantled -- THE Journal
