Microsoft Disrupts EvilTokens, an AI Chatbot Built for Cybercrime
Microsoft says it has disrupted EvilTokens, a cybercrime service that used AI at every step of the attack. The post is written by the Associate General Counsel of Microsoft's Digital Crimes Unit, so this is Microsoft's own account of its own legal action.
Transcript
Microsoft says it disrupted an AI chatbot built for cybercrime. Here is what it found.
EvilTokens was a cybercrime service. Its chatbot read a compromised inbox and suggested who to target and who to impersonate.
Microsoft links EvilTokens to more than twelve thousand compromised inboxes. Microsoft and its partners seized the websites behind the service.
It was sold through Telegram for a starting fee of fifteen hundred dollars. Investigators found the platform was partly built with AI.
This account comes from Microsoft and it does not name the operators. The two arrested men were released on bail and nobody has been convicted.
Inboxsmith builds AI phone and email agents for small business. Please like and subscribe for more news.
Sources
Every claim in this video comes from the top ranking coverage of this topic. The claims and where each one came from:
- Microsoft has disrupted EvilTokens, a cybercrime platform that used AI at every step from compromising email accounts to designing roadmaps for financial fraud and scams.(Microsoft (blogs.microsoft.com, On the Issues), first party corporate blog post titled "Disrupting EvilTokens: The AI Chatbot Built for Cybercrime", dated Sep 22, 2026, by Steven Masada, Associate General Counsel and General Manager of Microsoft's Digital Crimes Unit; read from the alert-time snapshot captured 2026-09-22T18:08:07Z and re-verified word for word against the live URL.)
- At the center of the service was an AI-style chatbot that could analyze a victim's inbox and help criminals identify trusted relationships, payment authorizations and sensitive responsibilities.(Microsoft (blogs.microsoft.com, On the Issues), first party corporate blog post titled "Disrupting EvilTokens: The AI Chatbot Built for Cybercrime", dated Sep 22, 2026, by Steven Masada, Associate General Counsel and General Manager of Microsoft's Digital Crimes Unit; read from the alert-time snapshot captured 2026-09-22T18:08:07Z and re-verified word for word against the live URL.)
- Preset prompts offered to find wire-transfer discussions, locate vendor invoices, and determine the best people to impersonate; the platform could recommend fraud strategies including drafting messages that impersonated trusted contacts.(Microsoft (blogs.microsoft.com, On the Issues), first party corporate blog post titled "Disrupting EvilTokens: The AI Chatbot Built for Cybercrime", dated Sep 22, 2026, by Steven Masada, Associate General Counsel and General Manager of Microsoft's Digital Crimes Unit; read from the alert-time snapshot captured 2026-09-22T18:08:07Z and re-verified word for word against the live URL.)
- Within months of launching in February 2026, EvilTokens had been linked to more than 12,000 compromised email inboxes across over 10,000 organizations worldwide.(Microsoft (blogs.microsoft.com, On the Issues), first party corporate blog post titled "Disrupting EvilTokens: The AI Chatbot Built for Cybercrime", dated Sep 22, 2026, by Steven Masada, Associate General Counsel and General Manager of Microsoft's Digital Crimes Unit; read from the alert-time snapshot captured 2026-09-22T18:08:07Z and re-verified word for word against the live URL.)
- Working with partners, Microsoft seized 50 websites used to operate the service and disabled more than 150 additional domains tied to its supporting infrastructure.(Microsoft (blogs.microsoft.com, On the Issues), first party corporate blog post titled "Disrupting EvilTokens: The AI Chatbot Built for Cybercrime", dated Sep 22, 2026, by Steven Masada, Associate General Counsel and General Manager of Microsoft's Digital Crimes Unit; read from the alert-time snapshot captured 2026-09-22T18:08:07Z and re-verified word for word against the live URL.)
- Sold through Telegram for a $1,500 initiation fee and a recurring $500 subscription.(Microsoft (blogs.microsoft.com, On the Issues), first party corporate blog post titled "Disrupting EvilTokens: The AI Chatbot Built for Cybercrime", dated Sep 22, 2026, by Steven Masada, Associate General Counsel and General Manager of Microsoft's Digital Crimes Unit; read from the alert-time snapshot captured 2026-09-22T18:08:07Z and re-verified word for word against the live URL.)
- Investigators found evidence that large portions of EvilTokens had been "vibe coded", with AI helping its creators build the platform itself, and that it drew on capabilities from multiple AI models.(Microsoft (blogs.microsoft.com, On the Issues), first party corporate blog post titled "Disrupting EvilTokens: The AI Chatbot Built for Cybercrime", dated Sep 22, 2026, by Steven Masada, Associate General Counsel and General Manager of Microsoft's Digital Crimes Unit; read from the alert-time snapshot captured 2026-09-22T18:08:07Z and re-verified word for word against the live URL.)
- This is Microsoft's own blog post about Microsoft's own civil legal action, written by an Associate General Counsel of Microsoft. No neutral party authored the account.(Microsoft (blogs.microsoft.com, On the Issues), first party corporate blog post titled "Disrupting EvilTokens: The AI Chatbot Built for Cybercrime", dated Sep 22, 2026, by Steven Masada, Associate General Counsel and General Manager of Microsoft's Digital Crimes Unit; read from the alert-time snapshot captured 2026-09-22T18:08:07Z and re-verified word for word against the live URL.)
- On September 11, 2026, Metropolitan Police Service officers arrested two men, aged 32 and 38, on suspicion of offenses connected with the alleged operation of EvilTokens. Both men have been released on police bail subject to conditions while the investigation continues, so no conviction is reported. The post never names the operators and never states how much money was actually stolen.(Microsoft (blogs.microsoft.com, On the Issues), first party corporate blog post titled "Disrupting EvilTokens: The AI Chatbot Built for Cybercrime", dated Sep 22, 2026, by Steven Masada, Associate General Counsel and General Manager of Microsoft's Digital Crimes Unit; read from the alert-time snapshot captured 2026-09-22T18:08:07Z and re-verified word for word against the live URL.)
- This action marks the Microsoft Digital Crimes Unit's 40th court-authorized disruption and is DCU's first action against an end-to-end AI-enabled cybercrime service.(Microsoft (blogs.microsoft.com, On the Issues), first party corporate blog post titled "Disrupting EvilTokens: The AI Chatbot Built for Cybercrime", dated Sep 22, 2026, by Steven Masada, Associate General Counsel and General Manager of Microsoft's Digital Crimes Unit; read from the alert-time snapshot captured 2026-09-22T18:08:07Z and re-verified word for word against the live URL.)