Breaking

Microsoft Disrupts EvilTokens as AI Account Abuse Becomes a Faster Cybercrime Channel

September 26, 2026 at 06:37 EDT

Security
AI Agents

Microsoft has disrupted EvilTokens, an AI-enabled phishing service that turned stolen Microsoft 365 inbox access into a packaged workflow for business email compromise, fraud planning and impersonation. The case lands amid broader warnings that attackers are hijacking AI accounts, tokens and compute to accelerate cybercrime rather than only using AI to write better phishing emails.

Sep. 2026 · AI cybercrime

AI account abuse becomes a fraud workflow

EvilTokens packaged device code phishing, inbox analysis and fraud targeting into a subscription service. The disruption shows how attackers are hijacking accounts and tokens, not just using AI to write lures.

12,000+

compromised inboxes

10,000+

organizations affected

15x

device code phishing rise

200,000

API requests in 2 minutes

Infrastructure action, drawn to scale

50websites seized

150+domains disabled

Each block represents about 10 infrastructure items. The disabled-domain count was at least three times the seized-website count.

How the service turned access into fraud

1. Lure

Trick the user into authorizing a device code.

→

2. Token

Capture access without needing the password.

→

3. Analyze

Use AI to find invoices, roles and trusted ties.

→

4. Impersonate

Draft targeted payment or account-change fraud.

Defensive takeaway

Phishing-resistant MFA, token revocation and tighter AI account monitoring are now core controls.

Remaining risk

Disrupting infrastructure slows one service, but the model of AI-assisted fraud can reappear elsewhere.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.