Live Feeds
● TRACKER Updated 3d ago Β· 57 sources tracked

Microsoft disrupts AI-assisted platform that compromised 12,000 accounts

Microsoft disabled a subscription-based AI platform that compromised 12,000 accounts across 10,000 global organizations. The attackers exploited OAuth device authentication to gain access. This action coincides with a wider crackdown on the Yam Store marketplace and the AI-powered phishing service EvilTokens. Separately, hackers are currently using fake invitations to OpenAI, SpaceX, and Anthropic events to steal Google and Microsoft credentials via phishing-as-a-service platforms. These incidents highlight a trend of using AI and high-profile tech brands to automate the theft of authentication sessions.

πŸŽ™οΈ

Listen to Live Briefing

Real-time synthesized voice briefing Β· Live Feeds Desk

⏱ ~3 min
Speed:
RSS Source map (57)
⚑ Key Developments & Real-Time Context
Text size:
  • βœ“ A subscription-based AI platform compromised 12,000 accounts across 10,000 organizations globally.
  • βœ“ The attack exploited OAuth device authentication processes.
  • βœ“ Microsoft disrupted the Yam Store marketplace and the AI-powered phishing service EvilTokens.
  • βœ“ Hackers are using fake OpenAI, SpaceX, and Anthropic event invitations to steal Microsoft and Google account credentials.
πŸ›‘οΈ Source Corroboration: 57 independent reporting domains (90% confidence) ⏱ Read time: ~2 min

What changed

Reports now link similar credential theft to fake OpenAI, SpaceX, and Anthropic event invitations.

Live updates

  1. Microsoft dismantles AI-driven platform targeting 12,000 accounts

    Microsoft disabled a subscription-based AI platform that compromised 12,000 accounts across 10,000 global organizations. The attackers exploited OAuth device authentication to gain access. This action coincides with a wider crackdown on the Yam Store marketplace and the AI-powered phishing service EvilTokens. Separately, hackers are currently using fake invitations to OpenAI, SpaceX, and Anthropic events to steal Google and Microsoft credentials via phishing-as-a-service platforms. These incidents highlight a trend of using AI and high-profile tech brands to automate the theft of authentication sessions.

    Why it matters

    The surge in AI-assisted phishing allows criminals to scale attacks and read inboxes automatically. This vulnerability led CEO Satya Nadella to advocate for treating AI models as potential insider threats. He proposed implementing tamper-proof logging and a human-operated emergency brake to kill models mid-task.

    What is confirmed

    • A subscription-based AI platform compromised 12,000 accounts across 10,000 organizations globally.
    • The attack exploited OAuth device authentication processes.
    • Microsoft disrupted the Yam Store marketplace and the AI-powered phishing service EvilTokens.
    • Hackers are using fake OpenAI, SpaceX, and Anthropic event invitations to steal Microsoft and Google account credentials.

    Still unconfirmed

    • CEO Satya Nadella urged treating advanced AI models as already compromised and called for a human-operated emergency brake.
    • Microsoft revoked over 200 fraudulent certificates to thwart a Rhysida ransomware campaign.

    What to watch next

    • Evidence of new phishing-as-a-service platforms mimicking other AI companies
    • Updates on the implementation of AI emergency brakes at Microsoft
    Sources used for this update (5)
    1. www.riverfrontai.com β€” The Current β€” AI news, and what it means for you | RiverfrontAI
    2. www.wionews.com β€” Microsoft's Nadella says treat every AI model as already ...
    3. www.cloudskope.com β€” Chainalysis Data Breach 2026: Agentic Attack Hits User Roster ...
    4. www.bleepingcomputer.com β€” Fake OpenAI, SpaceX events used to steal Microsoft, Google ...
    5. dailysecurityreview.com β€” Microsoft Revokes 200+ Fraudulent Certificates: Thwarts ...
    confidence 90%

  2. Microsoft disrupts AI-assisted platform compromising 12,000 accounts

    Microsoft dismantled a subscription-based platform using AI to compromise 12,000 accounts across 10,000 organizations globally. The operation exploited OAuth device authentication processes. This follows a broader disruption of a cybercriminal ecosystem involving the Yam Store marketplace and EvilTokens, a phishing service with AI-powered inbox reading capabilities.

    Why it matters

    The disruption of this AI-assisted platform is part of a larger effort to combat cybercrime. Microsoft's actions aim to protect users from account compromises and data breaches. The exploitation of OAuth device authentication processes highlights the evolving tactics of cybercriminals. This incident underscores the importance of robust cybersecurity measures.

    What is confirmed

    • Microsoft dismantled a subscription-based platform using AI to compromise 12,000 accounts across 10,000 organizations globally.
    • The operation exploited OAuth device authentication processes.
    • EvilTokens compromised thousands of Microsoft 365 accounts.
    • The FBI warns Kali365, a PhaaS platform on Telegram, exploits Microsoft device code authentication to bypass MFA entirely and capture persistent OAuth tokens.

    Still unconfirmed

    • The Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT) blocked internet access for external users after a cyberattack compromised around 200 accounts.

    What to watch next

    • Further updates on the Kali365 PhaaS platform and its impact on Microsoft 365 users
    • Details on the Yam Store marketplace and its connection to the disrupted cybercriminal ecosystem
    • Microsoft's future actions to prevent similar AI-assisted account compromises
    Sources used for this update (7)
    1. dailysecurityreview.com β€” FBI Warns Kali365 PhaaS Platform Bypasses Microsoft 365 MFA
    2. recentbreaches.com β€” Recent Breaches: Latest Data Breach News & Live Tracker (2026)
    3. swissobserver.com β€” Swiss Federal IT Office Hit by Cyberattack, Blocks External ...
    4. prevent-ransomware.com β€” EvilTokens: When AI Moves Faster Than Cybersecurity
    5. learn.microsoft.com β€” My Microsoft account was hacked - Microsoft Q&A
    6. learn.microsoft.com β€” I need to dispute charges in my Microsoft account on a day ...
    7. www.gadgetreview.com β€” Microsoft’s X Account Hijacked to Promote Fake Clippy Crypto ...
    confidence 90%

  3. Microsoft disrupts AI-assisted platform compromising 12,000 accounts

    Microsoft dismantled a subscription-based platform using AI to compromise 12,000 accounts across 10,000 organizations globally. The operation exploited OAuth device authentication processes. This follows a broader disruption of a cybercriminal ecosystem involving the Yam Store marketplace and EvilTokens, a phishing service with AI-powered inbox reading capabilities.

    Why it matters

    This incident highlights the growing threat of AI-assisted cybercrime and the importance of robust security measures. Microsoft's actions demonstrate efforts to combat these threats. The compromised accounts and organizations indicate a significant security breach. Microsoft's Digital Crimes Unit is actively involved in disrupting these malicious operations.

    What is confirmed

    • Microsoft compromised a subscription-based platform using AI to compromise 12,000 accounts across 10,000 organizations globally.
    • The operation exploited OAuth device authentication processes to gain access.
    • Microsoft's Digital Crimes Unit seized 50 sites and disabled 150 domains behind EvilTokens.
    • EvilTokens used AI to read stolen inboxes to plan fraud.
    • Attackers used stolen Microsoft 365 session tokens to breach 79 organizations.
    • The attackers recorded 497 successful sign-ins and over 200,000 failed attempts.
    • The campaign compromised 97 accounts and registered 48 rogue Entra devices.

    What to watch next

    • Further details on the EvilTokens disruption
    • Microsoft's plans to prevent similar AI-assisted cyber attacks
    • The impact on affected organizations and users
    Sources used for this update (5)
    1. www.orcarouter.ai β€” Microsoft Dismantles EvilTokens and Its AI Inbox Reader
    2. forkast.news β€” Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at ...
    3. cybersecuritynews.com β€” Hackers Hijack Microsoft 365 Accounts at 79 Organizations ...
    4. thehackernews.com β€” Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at ...
    5. aviatrix.ai β€” Microsoft 365 Token-Replay AitM Attack: 97 Accounts, 79 Orgs ...
    confidence 100%

  4. Microsoft disrupts AI-assisted platform compromising 12,000 accounts

    Microsoft has dismantled a subscription-based platform that used AI to compromise 12,000 accounts across 10,000 organizations globally. The operation exploited OAuth device authentication processes to gain access. This action follows a broader disruption of a cybercriminal ecosystem involving the Yam Store marketplace.

    Why it matters

    This incident highlights the growing threat of AI-assisted cyber attacks. Microsoft's disruption of the platform is a significant blow to cybercriminals, but other attackers continue to impersonate AI brands to distribute malware and steal browser sessions from US companies.

    What is confirmed

    • Microsoft dismantled EvilTokens, a subscription-based platform that used AI to compromise 12,000 accounts across 10,000 organizations globally.
    • The operation exploited OAuth device authentication processes to gain access.
    • China-aligned group Storm-0940 used the ARTEX AI agent framework to reach Microsoft 365 tenants through ConnectWise Cloud Backup apps.
    • Automated password guessing failed, but stolen app credentials needed no user sign-in at all.

    Still unconfirmed

    • A person reported their Microsoft account was hacked, with the hacker changing all information, including the associated email, and recovery tools did not work.
    • Another user reported their Outlook.com account was compromised through a malicious OAuth app and an attacker was still inserting items into their account.

    What to watch next

    • Further developments on Microsoft's efforts to combat AI-assisted cyber attacks
    • Investigations into the impact of the ConnectWise attack on Microsoft 365 tenants
    • Release of patches for the exploited Microsoft SharePoint zero-day vulnerability
    Sources used for this update (10)
    1. arstechnica.com β€” Category: Biz & IT - Ars Technica
    2. dailysecurityreview.com β€” Widespread Cyberattack Exploits Microsoft SharePoint Zero-Day ...
    3. hackernoob.tips β€” Cybersecurity Tips & Tutorials for Beginners | HackerNoob.tips
    4. thenextweb.com β€” Microsoft says China-aligned hackers used AI agents in ConnectWise attack
    5. learn.microsoft.com β€” Account hacked all recovery information changed - Microsoft Q&A
    6. learn.microsoft.com β€” My account has been deleted or hacked. - Microsoft Q&A
    7. dailysecurityreview.com β€” Password-Spraying Campaign Hits Over 80,000 Microsoft Entra ...
    8. learn.microsoft.com β€” Outlook account has been compromised - Microsoft Q&A
    9. www.tomshardware.com β€” China-aligned hackers deploy AI agents in massive ConnectWise ...
    10. learn.microsoft.com β€” Account has been hacked - Microsoft Q&A
    confidence 90%

  5. Microsoft disrupts EvilTokens AI platform compromising 12,000 accounts

    Microsoft dismantled EvilTokens, a subscription-based platform that used AI to compromise 12,000 accounts across 10,000 organizations globally. The operation exploited OAuth device authentication processes to gain access. This action follows a broader disruption of a cybercriminal ecosystem involving the Yam Store marketplace, which facilitated over one billion malicious messages targeting 75,000 organizations across 150 countries. While Microsoft used AI analysis to identify this infrastructure, other attackers are currently impersonating AI brands to distribute malware and steal browser sessions from US companies.

    Why it matters

    The shift toward AI-assisted attacks allows criminals to scale credential theft and impersonation more efficiently. These campaigns place significant operational pressure on Managed Security Service Providers by triggering repetitive investigations across multiple clients. The use of OAuth exploitation shows a move toward bypassing traditional password-based security.

    What is confirmed

    • Microsoft disrupted the subscription-based platform EvilTokens.
    • EvilTokens compromised 12,000 accounts across 10,000 organizations worldwide.
    • The platform exploited OAuth device authentication processes.
    • A global disruption hit a network responsible for over one billion malicious messages targeting more than 75,000 organizations.

    Still unconfirmed

    • ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October 2026.
    • Fake AI campaigns targeting US businesses account for 16% of country-attributed targets.

    What to watch next

    • Evidence of new OAuth exploitation methods used by other subscription-based AI platforms
    • Reports of recovered accounts or data leaks originating from the EvilTokens breach
    Sources used for this update (4)
    1. thehackernews.com β€” ⚑ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
    2. rocketnews.com β€” Microsoft disrupts AI-assisted platform that compromised ...
    3. thehackernews.com β€” Fake AI Attacks Spread Across US Companies: How MSSPs Can ...
    4. www.bleepingcomputer.com β€” Global takedown hits network behind 1 billion phishing messages
    confidence 90%

  6. Microsoft and Health-ISAC Target Transnational Cybercrime Infrastructure

    Microsoft and Health-ISAC disrupted cybercrime services linked to over one billion malicious messages targeting organizations globally. The Yam Store marketplace provided kits allowing criminals to impersonate organizations and steal credentials, impacting over 75,000 organizations. Artificial intelligence analysis helped identify the underlying infrastructure of this operation. Meanwhile, individual users continue to report unauthorized account takeovers involving changed passwords, removed security details, and deleted passkeys following verification code compromise.

    Why it matters

    The disruption highlights ongoing efforts by technology firms and health information sharing organizations to dismantle industrial-scale phishing operations. These criminal networks utilize automated toolkits and artificial intelligence to execute mass credential harvesting campaigns. The persistence of individual account compromises indicates that threat actors retain various methods to lock legitimate users out of personal systems.

    What is confirmed

    • Microsoft and Health-ISAC disrupted cybercrime services behind more than one billion malicious messages targeting organizations worldwide.
    • The Yam Store sold kits that helped criminals impersonate organizations, steal credentials, and target more than 75,000 organizations worldwide.
    • AI-assisted analysis helped identify the infrastructure behind the Yam Store operation.

    Still unconfirmed

    • A personal Microsoft account was compromised on October 11, 2026, after an attacker changed the password, modified security details, and removed the original Gmail address.
    • An individual account was stolen after the user accidentally provided a verification code, leading to an immediate notification that the passkey was deleted.

    What to watch next

    • Additional law enforcement disclosures regarding the operators of the Yam Store
    • Further technical reports from Microsoft and Health-ISAC on the disrupted messaging infrastructure
    • Updates on user recovery options for accounts experiencing modified security details and deleted passkeys
    Sources used for this update (4)
    1. learn.microsoft.com β€” Microsoft account was hacked β€” can the account be suspended ...
    2. blogs.microsoft.com β€” Disrupting the service economy behind transnational ...
    3. www.computerworld.com β€” As phishing-as-a-service goes industrial, Microsoft takes ...
    4. learn.microsoft.com β€” Compromised Microsoft Account - Microsoft Q&A
    confidence 100%

  7. Microsoft and Law Enforcement Disrupt AI-Assisted EvilTokens

    Microsoft and law enforcement dismantled the subscription-based EvilTokens platform in a court-authorized operation on September 22. The malicious service charged criminals a fee to automate email takeovers and target token-based accounts. EvilTokens used artificial intelligence across its attack chain to automate phishing and OAuth exploitation, successfully compromising 12,000 Microsoft accounts and inboxes across 10,000 organizations worldwide over several months. United Kingdom police arrested two suspects during the operation, which also seized 50 websites.

    Why it matters

    Cybercriminals increasingly leverage automated tools and artificial intelligence to scale phishing operations and bypass traditional security measures. Token-based attacks and OAuth exploitation represent a rising threat to corporate networks, allowing attackers to maintain access without needing traditional passwords. Disrupting platforms that sell these capabilities as a service helps blunt large-scale corporate account takeovers.

    What is confirmed

    • Microsoft disrupted EvilTokens, a subscription-based platform that used AI to compromise 12,000 Microsoft accounts across 10,000 organizations worldwide over several months.

    What to watch next

    • Further legal proceedings against the two suspects arrested by United Kingdom police
    • Additional seizures or disruptions of related AI-assisted phishing platforms
    Sources used for this update (9)
    1. account.microsoft.com β€” Microsoft account | Sign In or Create Your Account Today ...
    2. careers.microsoft.com β€” Jobs in Seattle | Microsoft Careers
    3. apps.microsoft.com β€” Microsoft Store - Download apps, games & more for your Windows PC
    4. arstechnica.com β€” Tag: AI - Ars Technica
    5. rewards.bing.com β€” About – Microsoft Rewards
    6. arstechnica.com β€” Category: Security - Ars Technica
    7. finance.yahoo.com β€” North Carolina woman loses $22,500 after fake Microsoft pop-up let scammers gain access to her bank accounts
    8. rocketnews.com β€” Microsoft disrupts AI-assisted platform that compromised ...
    9. www.theverge.com β€” Satya Nadella says we should assume all AI models are ...
    confidence 100%

  8. Microsoft Dismantles AI-Powered EvilTokens Platform

    Microsoft and law enforcement dismantled the subscription-based EvilTokens platform, a malicious service that charged criminals a fee to automate email takeovers and target token-based accounts. The court-authorized September 22 operation seized 50 websites and led to the arrest of two suspects by United Kingdom police. EvilTokens integrated artificial intelligence across its attack chain to automate phishing and OAuth exploitation, successfully compromising 12,000 Microsoft accounts and inboxes across 10,000 organizations worldwide.

    Why it matters

    The operation highlights the growing operational sophistication of cybercriminals leveraging artificial intelligence to scale automated attacks. EvilTokens functioned as a subscription service, lowering technical barriers for threat actors by using AI to handle fraud preparation and mimic human communication. This disruption addresses a critical vector in modern enterprise security threats.

    What is confirmed

    • Microsoft and industry partners dismantled the subscription-based EvilTokens platform, which leveraged artificial intelligence to automate phishing and OAuth exploitation.
    • The court-authorized September 22 operation seized 50 websites and resulted in United Kingdom police arresting two suspects connected to the service.
    • The cybercrime network compromised 12,000 Microsoft accounts and inboxes across 10,000 organizations.

    Still unconfirmed

    • The EvilTokens platform charged criminals a subscription fee of $1,500-a-month for its phishing software-as-a-service.

    What to watch next

    • Further legal proceedings and court dates for the two suspects arrested by United Kingdom police.
    • Additional disclosures from Microsoft regarding other potential criminal networks using similar artificial intelligence tools.
    Sources used for this update (3)
    1. quiversphere.com β€” Microsoft dismantles AI-driven platform linked to 12,000 ...
    2. gokhshtein.com β€” Microsoft Dismantles $1,500-a-Month Phishing SaaS | Gokhshtein
    3. www.thetechedvocate.org β€” This One AI Phishing Scam Just Hijacked 12,000 Accounts ...
    confidence 100%

  9. Microsoft and UK Police Dismantle AI Phishing Platform EvilTokens

    Microsoft and industry partners dismantled the subscription-based EvilTokens platform, which leveraged artificial intelligence to automate phishing and OAuth exploitation against organizations worldwide. The court-authorized September 22 operation seized 50 websites and resulted in United Kingdom police arresting two suspects connected to the service. According to Microsoft, the cybercrime network compromised 12,000 Microsoft accounts and inboxes across 10,000 organizations. The service integrated artificial intelligence throughout its attack chain to handle fraud preparation and target token-based Microsoft 365 accounts.

    Why it matters

    The dismantling of EvilTokens comes as security researchers warn that generative artificial intelligence is giving cybercriminals an immediate operational advantage. Microsoft published its 2026 Security Report highlighting that autonomous ransomware has begun striking real organizations, pointing to an attack named JADEPUFFER in July 2026. These developments demonstrate how artificial intelligence tools are lowering the cost and complexity of cyberattacks, prompting heavy spending on security and forcing foundational AI developers to re-evaluate their own safety practices.

    What is confirmed

    • Microsoft disrupted the EvilTokens subscription-based platform that utilized artificial intelligence for automated phishing and OAuth exploitation.
    • The EvilTokens platform compromised 12,000 accounts across 10,000 organizations worldwide.
    • A court-authorized operation seized 50 websites linked to the phishing service.
    • United Kingdom police arrested two men suspected of offenses connected to the EvilTokens phishing service.
    • Microsoft announced the court-authorized takedown of the phishing service on September 22.

    Still unconfirmed

    • OpenAI halted the training of its most powerful model following a summer security breach where malicious artificial intelligence agents targeted the government.

    What to watch next

    • Further legal proceedings against the two suspects arrested in the United Kingdom.
    • Additional enforcement actions by Microsoft and industry partners against remaining infrastructure linked to token-based account takeovers.
    Sources used for this update (11)
    1. yoda.co.kr β€” AI μ—μ΄μ „νŠΈ λ³΄μ•ˆΒ·μƒκ±°λž˜Β·λͺ¨λΈ 경쟁 격화 β€’ μš”λ‹€ ν•œλ§ˆλ””
    2. rocketnews.com β€” Microsoft disrupts AI-assisted platform that compromised ...
    3. investingsage.com β€” AI Cybersecurity Is Becoming a New Cost of the AI Boom
    4. www.aiaffairs.com β€” Microsoft disrupts EvilTokens platform linked to more than ...
    5. www.techtimes.com β€” Microsoft 2026 Security Report: Autonomous Ransomware Has Hacked Real Organizations
    6. www.crime-research.org β€” Microsoft Dismantles EvilTokens, an AI-Powered Phishing ...
    7. rocketnews.com β€” Microsoft disrupts AI-assisted platform that compromised ...
    8. rocketnews.com β€” Microsoft disrupts AI-assisted platform that compromised ...
    9. techhelp.ca β€” Microsoft Disrupts EvilTokens AI Phishing Service
    10. dataphoenix.info β€” Microsoft disrupts EvilTokens AI cybercrime service β€” Data ...
    11. dailysecurityreview.com β€” Microsoft Seizes 50 EvilTokens Phishing Sites, UK Arrests 2
    confidence 95%

  10. Microsoft disrupts AI-assisted platform that compromised 12,000 accounts

    Microsoft has dismantled EvilTokens, an AI-powered cybercrime platform that compromised 12,000 email accounts across 10,000 organizations worldwide. The platform, which emerged in February 2026, offered a subscription-based service to automate phishing campaigns and analyze stolen inboxes. Microsoft, along with industry partners including Coinbase, seized 50 websites and arrested individuals operating the network.

    Why it matters

    This operation highlights the growing threat of AI-assisted cybercrime and the importance of collaboration between tech companies and law enforcement to combat such threats. The disruption of EvilTokens is a significant win for cybersecurity efforts, but the existence of such platforms poses ongoing risks to individuals and organizations. The use of AI in cybercrime is a rapidly evolving area that requires continued vigilance.

    What is confirmed

    • Microsoft disrupted an AI-enabled cybercrime platform called EvilTokens.
    • EvilTokens compromised more than 12,000 email inboxes across over 10,000 organisations worldwide.
    • The platform emerged in February 2026 and was offered to cybercriminals as a subscription-based service.
    • Microsoft and Coinbase helped dismantle EvilTokens.
    • Authorities seized 50 websites to dismantle the primary infrastructure.

    Still unconfirmed

    • The operation combined account compromise, email analysis, target identification and fraud preparation.

    What to watch next

    • Further details on the arrested suspects and their trial
    • The impact of the disruption on the cybercrime landscape
    • Microsoft's future efforts to combat AI-assisted cybercrime
    Sources used for this update (7)
    1. www.newsmobile.in β€” Microsoft Takes Down Platform Used In 12,000 Account Hacks
    2. emergent.sh β€” Microsoft Disrupts AI Platform Behind 12,000 Account Hack
    3. thejournal.com β€” AI Platform Behind 12,000 E-mail Breaches Dismantled
    4. rocketnews.com β€” Microsoft disrupts AI-assisted platform that compromised ...
    5. thehackernews.com β€” Cybercrime | Breaking Cybersecurity News | The Hacker News
    6. cryptoslate.com β€” Coinbase traced $1.1 million crypto trail behind AI phishing service EvilTokens
    7. www.latestly.com β€” Microsoft Dismantles EvilTokens Cybercrime Platform That Used ...
    confidence 95%

  11. Microsoft Disables AI Phishing Platform EvilTokens

    Microsoft and industry partners disrupted the EvilTokens phishing-as-a-service platform, which used artificial intelligence to automate account takeovers and analyze stolen inboxes. The service compromised 12,000 accounts through device code phishing lures and automated infrastructure. Advertised via a Telegram channel for a monthly subscription fee, EvilTokens allowed buyers to execute mass cyberattacks. A joint probe between Microsoft and Coinbase resulted in the arrest of the individuals operating the network, while Microsoft seized 50 websites to dismantle the primary infrastructure.

    Why it matters

    EvilTokens functioned as an end-to-end subscription model that lowered the technical barriers required to launch sophisticated device code phishing campaigns. The Microsoft Digital Crimes Unit coordinated legal and operational actions alongside law enforcement, Health-ISAC, and industry partners to target the infrastructure. SpyCloud contributed threat intelligence tracking more than 8,700 compromised accounts to assist in the takedown.

    What is confirmed

    • Microsoft led an industry-wide takedown of the EvilTokens phishing-as-a-service platform.
    • EvilTokens utilized device code phishing and token theft alongside AI-assisted lures to compromise 12,000 accounts.
    • The platform was marketed through a Telegram channel and operated as a subscription service.
    • Microsoft seized 50 websites during the operation.
    • SpyCloud data on more than 8,700 compromised accounts contributed to the takedown effort.

    Still unconfirmed

    • A joint probe between Microsoft and Coinbase led directly to the arrest of the individuals operating the EvilTokens network.

    What to watch next

    • Further law enforcement announcements regarding additional arrests of EvilTokens subscribers or operators
    • Technical disclosures detailing the specific AI chatbot architecture used by the phishing platform
    Sources used for this update (10)
    1. arstechnica.com β€” Dan Goodin
    2. www.techflowpost.com β€” TechFlow Intel: OpenAI halts training for its most advanced model, ASML projects "zero sales" in Europe for 2026
    3. arstechnica.com β€” Microsoft disrupts AI-assisted platform that compromised 12,000 accounts
    4. www.microsoft.com β€” Unmasking EvilTokens: Getting to the root of device code phishing | Microsoft Security Blog
    5. spycloud.com β€” See No EvilTokens: Disrupting the EvilTokens PhaaS Platform
    6. flipboard.com β€” India’s education system is failing in new ways
    7. www.techspot.com β€” Microsoft takes down EvilTokens phishing service that used AI to mine hacked inboxes for payment fraud
    8. blog.hangadac.com β€” AI ν”Όμ‹± 이블토큰 1만2천 계정 ν„Έλ¦° μˆ˜λ²• - μ²œμ˜λ¬΄λ΄‰
    9. blogs.microsoft.com β€” Disrupting EvilTokens: The AI Chatbot Built for Cybercrime - Microsoft On the Issues
    10. daily.dev β€” Microsoft disrupts AI-assisted platform that compromised...
    confidence 95%

  12. Microsoft and Coinbase disrupt AI-powered EvilTokens phishing network

    Microsoft disrupted an AI-assisted phishing platform known as EvilTokens that compromised 12,000 accounts. A joint probe between Microsoft and Coinbase led to the arrest of the individuals operating the network. The service functioned as a DIY phishing operation powered by AI and has now lost access to its primary infrastructure. The attack focused on device code phishing to gain unauthorized account access.

    Why it matters

    Device code phishing bypasses traditional security by tricking users into authorizing a malicious device. The use of AI to automate these attacks allows criminals to scale phishing operations rapidly. This disruption prevents the network from targeting further victims using its automated tools.

    What is confirmed

    • Microsoft disrupted an AI-assisted platform that compromised 12,000 accounts.
    • A joint probe by Microsoft and Coinbase led to the arrest of the individuals behind EvilTokens.
    • EvilTokens was a DIY phishing network powered by AI.
    • The phishing service lost access to its key infrastructure.

    What to watch next

    • Details on the specific AI tools used to automate the phishing process
    • Legal proceedings and sentencing for the arrested operators
    Sources used for this update (5)
    1. Ars Technica β€” Microsoft disrupts AI-assisted platform that compromised 12,000
    2. Microsoft β€” Unmasking EvilTokens: Getting to the root of device code phishing
    3. Coinbase β€” Consumer Protection Tuesday: Taking Down Evil Tokens
    4. Fortune β€” Microsoft and Coinbase probe leads to arrest of crooks behind 'EvilTokens', a DIY phishing network powered by AI
    5. Axios β€” A major AI-powered phishing service has lost access to its key infrastructure
    confidence 100%
πŸ“Š

Community Sentiment: How do you assess this situation?

Voice your perspective Β· Real-time aggregated sentiment from the Live Feeds community