How did an AI chatbot turn email compromise into a fraud assembly line?

EvilTokens launched in February 2026. Within months it had been linked to more than 12,000 compromised email inboxes across over 10,000 organizations worldwide.

Victim activity concentrated in the United States, Canada, the United Kingdom, Australia, India, and France. Affected organizations ranged from wholesale distribution and construction to financial services, real estate, higher education, and healthcare.

The chatbot that read your inbox for criminals

Its AI chatbot analyzed a victim's inbox to identify trusted relationships, payment authorizations, and sensitive responsibilities. Preset prompts offered to find wire-transfer discussions, identify the organization's "money movers," locate vendor invoices, and determine the best people to impersonate.

Criminals tricked victims into entering an authentication code on Microsoft's legitimate sign-in page. By completing the normal authentication sign-in process, victims unknowingly gave criminals access to their email accounts without revealing their passwords. That access could persist even after a password reset if the associated sessions and tokens were not also revoked.

Once inside, the AI tools could summarize and translate emails, surface financial conversations, map organizational roles, identify trusted relationships, and recommend potential targets. Capabilities that once required experience across identity attacks, cloud systems, social engineering, and financial fraud were available through a ready-made interface.

A commercial cybercrime platform

The platform was sold through Telegram for a $1,500 initiation fee and a recurring $500 subscription, combining account compromise, mailbox analysis, target selection, and fraud preparation in a single service. Investigators found evidence that large portions of EvilTokens had been "vibe coded," with AI helping its creators build the platform itself. They also determined that EvilTokens drew on capabilities from multiple AI models.

The result was more than a collection of attack tools. EvilTokens packaged much of the fraud process into a commercially run service, complete with subscription pricing, customer support, management dashboards, and tools designed to move customers from account access toward financial exploitation.

Disruption across borders

No single organization could disrupt EvilTokens alone. The service relied on hosting providers, cloud services, AI tools, financial services, and other online resources that cybercriminals repurposed to support fraud at scale.

Working with Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, and TRM Labs, Microsoft and Health-ISAC took action against key parts of the platform. Authorization came from the U.S. District Court for the Eastern District of Virginia.

The operation seized 50 websites used to operate the service and disabled more than 150 additional domains tied to its supporting infrastructure. In the United Kingdom, the Metropolitan Police Service's cybercrime team arrested two men on suspicion of offenses connected with the alleged operation of EvilTokens. On September 11, 2026, officers arrested two men aged 32 and 38, and seized digital devices and other items for examination. Both men have been released on police bail subject to conditions while the investigation continues.

Investigators used reverse engineering and AI-powered tools to analyze evidence, accelerate the investigation, and identify the infrastructure supporting the service.

What changes for defenders

This action marks the Microsoft Digital Crimes Unit's 40th court-authorized disruption spanning nearly two decades of targeting cyber threat actors, malicious tools, and supporting infrastructure. It is also DCU's first action against an end-to-end AI-enabled cybercrime service.

The infrastructure supporting EvilTokens has been disrupted, but the model it demonstrated will not disappear with it. For organizations, the lesson is: assume that once an inbox is compromised, criminals may understand its contents in minutes, not days. Strong identity protections and monitoring remain essential. Organizations should also independently verify requests to change payment information or redirect funds. They should also verify requests to approve unusual transactions through a trusted second channel.