Skip to main content

Microsoft Helps Take Down Massive Automated, AI-Powered Phishing-as-a-Service Platform

1 month 2 weeks ago
Microsoft's security blog describes the fight against a new "AI-powered cybercrime platform" offering phishing-as-a-service, with AI-tailored lures and analyses of compromised inboxes (to identify high-value targets). The site compromised more than 12,000 inboxes in over 10,000 organizations around the world, compromising business accounts "at scale" with automated attacks and prebuilt phishing templates. AI tools could even sift through a victim's mailbox to help engineer better phishing messages. To disrupt EvilTokens Microsoft worked with other organizations, including Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, Shadowserver Foundation, and TRM Labs to Health-ISAC (a non-profit helping health sector organizations share cyber threat information). "Fifty sites seized and 150 domains disabled in a single action is only possible when the hosting providers, the exchanges, the model providers and the data holders all move at the same time," security company SpyCloud told The Hacker News. From Microsoft's security blog: Microsoft also notified affected customers, helped remediate compromised accounts, and shared intelligence to support further defensive and investigative action... Microsoft worked closely with specialist officers from the Metropolitan Police Service's cybercrime team, sharing intelligence that enabled officers to take operational action in the United Kingdom. On September 11, 2026, officers arrested two men, aged 32 and 38, and seized digital devices and other items for examination... While EvilTokens used AI to identify targets and prioritize fraud opportunities, Microsoft investigators used reverse engineering and AI-powered tools to analyze evidence, accelerate the investigation, and identify the infrastructure supporting the service... Campaigns leveraging EvilTokens have impacted organizations in various industries, including wholesale distribution, construction, financial services, real estate, higher education, and healthcare, with the highest concentrations of observed victim activity in the United States, Canada, the United Kingdom, Australia, India, and France. Working with partners, Microsoft's Digital Crimes Unit (DCU) facilitated a coordinated disruption of infrastructure used to operate the EvilTokens service. Sometimes stolen tokens were used to give new devices access to a victim's inbox. (A code authenticating the new device was sent to the targeted user, who unknowingly authorize the threat actor's session and grants access to their account...) But "AI was not simply helping attackers write more convincing messages," says another Microsoft blog post. "It helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible." The significance of EvilTokens extends beyond its rapid growth and global reach. It offers an early warning of what happens when cybercriminals combine stolen access with AI capable of understanding how an organization works... Its AI tools could summarize and translate emails, surface financial conversations, map organizational roles, identify trusted relationships, and recommend potential targets. Preset prompts offered to find wire-transfer discussions, identify the organization's "money movers," locate vendor invoices, and determine the best people to impersonate. Sold through Telegram for a $1,500 initiation fee and a recurring $500 subscription, EvilTokens combined account compromise, mailbox analysis, target selection, and fraud preparation in a single service. Capabilities that once required experience across identity attacks, cloud systems, social engineering, and financial fraud were available through a ready-made interface. Investigators found evidence that large portions of EvilTokens had been "vibe coded," with AI helping its creators build the platform itself. They also determined that EvilTokens drew on capabilities from multiple AI models. The result was more than a collection of attack tools. EvilTokens packaged much of the fraud process into a commercially run service, complete with subscription pricing, customer support, management dashboards, and tools designed to move customers from account access toward financial exploitation.

Read more of this story at Slashdot.

EditorDavid

It's all Part 1 of the Process

1 month 2 weeks ago

Our submitter Tim C. shares his tale of an especially brutal culture clash:

I had co-founded a software startup doing stock market surveillance. In the early 2000s, the WTF Exchange (WTFX) was a major customer of ours. We were one part of a major project of theirs, a complete overhaul of their trading engine and IT systems.

Compared to our other clients, WTFX was quite bureaucratic. There seemed to be a strong focus on the process, rather than the mission or the result. They were even explicit about this, telling us, "The process is the deliverable."

I believe they made that explicit in talking to us because our culture was quite agile and thereby contrasted, or clashed, with the culture of everyone else working on the project.

"Predictability" was another buzzword they used to admonish us. We were required and expected to abide by the grand "waterfall" design and project plan and project timeline. The grand project was controlled via an enormous Gantt chart and they hated having to make any change to the Gantt chart.

There was one report which was central to the Exchange's surveillance department. The occasional opportunities I got to talk directly to end-users, they always stressed the importance of this report, and the importance of it updating immediately to changes in the filtering criteria, and the importance of the fine details such as colour-coding cells based on certain rules.

It became clear to me that we could not handle this report using a report definition file fed into our general report-writing module. It called for a custom piece of software. So over the course of the next weekend, in my hotel room, I whipped up a solution for these users: a whole new module to be added to our suite. It was maybe not perfect, but it was largely complete by the time I proudly unveiled my creation the next Monday.

However, instead of a pat on the back, I was greeted by looks of horror. This module had a whole new name, was not mentioned anywhere in the giant Gantt chart, had never been mentioned before as a concept in any specification document.

I had failed at "predictability." I had unleashed on the poor customer an urgent requirement to do a whirlwind set of meetings and priority changes and updates to the specification documentation and the giant Gantt chart.

In short, I had thrown the whole project into chaos.

This wasn't Tim's last brush with bureaucracy gone mad! Stay tuned for Part 2.

[Advertisement] BuildMaster allows you to create a self-service release management platform that allows different teams to manage their applications. Explore how!
Ellis Morning