Microsoft takes down EvilTokens service that used AI to turn stolen inboxes into payment fraud
Serving tech enthusiasts for over 25 years.
TechSpot means tech analysis and advice you can trust.
The takeaway: Cybercriminals used a subscription service called EvilTokens to steal access to Microsoft accounts and mine victims' inboxes for payment information, internal reporting lines and trusted business contacts. Microsoft said the platform's AI-assisted tools compromised 12,000 customer accounts at 10,000 organizations over several months.
The service, marketed through a Telegram channel, combined device-code phishing with automated analysis of stolen inboxes. Microsoft said it has now disrupted the operation, seizing 50 websites and 150 additional domains through legal action and partner coordination. The Metropolitan Police Service in the United Kingdom also arrested two men on suspicion of offenses linked to the platform.
EvilTokens charged a $1,500 entry fee and $500 a month. Its customers could send phishing emails at scale and direct recipients to fraudulent pages designed to exploit Microsoft's device-code authentication...
Copyright of this story solely belongs to www.techspot.com. To see the full text click HERE
