Microsoft takes down AI-powered cybercrime platform that targeted 12,000+ accounts
What's the story
Microsoft has taken down a subscription-based cybercrime platform that used an AI chatbot to help hackers break into over 12,000 accounts. The service, called EvilTokens, automated many aspects of the fraud process. From identifying potential targets and analyzing their inboxes to creating convincing messages aimed at redirecting payments, EvilTokens simplified account takeovers for its users.
Subscription model
EvilTokens charged customers $1,500 for access
EvilTokens, which appeared on Telegram in February, charged customers $1,500 for access to the service and a monthly fee of $500.
The platform was used by hackers to break into more than 12,000 accounts over several months.
Instead of just providing tools for breaking into accounts, EvilTokens integrated different stages of a fraud campaign.
AI involvement
AI's role in the operation
Microsoft highlighted that the role of AI in this operation was more than just generating text.
The technology helped attackers decide who to target, who to impersonate, and how to exploit relationships for maximum financial gain.
The platform also automated large-scale spam campaigns, allowing customers to send messages with malicious links or attachments to potential victims.
Exploitation details
How EvilTokens worked
EvilTokens exploited Microsoft's legitimate device-code authentication system, a login method for devices without a traditional web browser interface.
The platform used phishing emails to lure potential victims to attacker-controlled webpages.
Automated scripts then interacted with Microsoft's identity systems and generated device codes, which victims were tricked into entering on Microsoft's genuine device login page.
This could give the attacker control of a device session associated with the victim's account.
Global impact
Microsoft took down 50 websites associated with the service
EvilTokens primarily targeted users in the US, Canada, UK, Australia, India and France.
Victims included organizations in wholesale distribution, construction, financial services, real estate, higher education and healthcare.
Microsoft worked with partners to take down 50 websites associated with the service and disable over 150 other domains supporting its infrastructure.