Microsoft said Tuesday it led an industry-wide disruption of a subscription-based scam platform that used an AI chatbot to compromise 12,000 Microsoft accounts over a few months. Named Evil Tokens, the platform launched on Telegram in February and charged an initial $1,500 fee plus a recurring $500 monthly charge.

Evil Tokens streamlined email account compromises, helping customers analyze inboxes, select high-payout targets, and draft convincing follow-up emails to trick employees into transferring funds. "At the center of the service was an AI-style chatbot that could analyze a victim's inbox and help criminals identify trusted relationships, payment authorizations, and sensitive responsibilities," Microsoft said.

Users compromised 12,000 accounts across 10,000 organizations worldwide, mostly in the US, followed by Canada, the UK, Australia, India, and France. Victims spanned wholesale distribution, construction, financial services, real estate, higher education, and healthcare.

Microsoft seized 50 websites and 150 domains used to operate Evil Tokens. The UK's Metropolitan Police Service arrested two men. Compromises used legitimate OAuth device code authentication.