Microsoft says it helped disrupt EvilTokens, a subscription-based scam platform that allegedly used an AI-style chatbot to accelerate account compromise and business fraud. The tasteful innovation, naturally, was not better security. It was turning inbox looting into a managed service with a monthly plan.

According to Ars Technica, Microsoft said the platform was linked to the compromise of 12,000 Microsoft accounts across 10,000 organizations. It reportedly charged an initial $1,500 fee plus $500 per month. Because even digital crime, having stared into the abyss, has discovered SaaS pricing.

🤚 The Open-Palm Subscription

EvilTokens was not merely another phishing kit wearing a cheap mask and asking accounting to “kindly do the needful.” Microsoft described it as an end-to-end platform for compromising email accounts, analyzing inboxes, identifying useful relationships, and recommending fraud strategies. The alleged centerpiece was an AI-style chatbot that could examine compromised mailboxes and surface the human weaknesses most likely to turn into money.

That is the grim little milestone here. The attacker no longer has to personally read thousands of emails to understand who approves payments, who trusts whom, which vendors are legitimate, and where the pressure points sit. The machine can perform the corporate anthropology. It can study your org chart, your suppliers, your tone, your habits, and your fondness for approving things at 4:57 p.m. on a Friday.

Microsoft said victims were concentrated most heavily in the United States, with other affected countries including Canada, the United Kingdom, Australia, India, and France. Targeted sectors reportedly included wholesale distribution, construction, financial services, real estate, higher education, and healthcare — in other words, the traditional buffet of organizations where payment workflows are complex, urgent, and occasionally held together with Outlook rules and vibes.

👐 The Two-Handed Device-Code Ballet

The compromise mechanism described by Ars and Microsoft leaned on device code authentication, a legitimate OAuth flow designed for devices like TVs and other hardware where typing a normal password is inconvenient. The victim is shown a code and told to enter it into an official Microsoft login page. In a lawful universe, this connects a constrained device. In the fraud version, it authorizes an attacker-controlled session while everyone admires how official the page looks.

EvilTokens allegedly automated much of this ritual. Lures pushed victims toward pages that generated device codes in real time, then instructed them to enter those codes into Microsoft’s own portal. The trick works because legitimacy has excellent branding. The user sees the real login domain and relaxes, unaware that the velvet rope leads directly into someone else’s casino.

Microsoft said the disruption seized 50 websites and 150 additional domains used by the operation. The UK Metropolitan Police Service also arrested two men on suspicion of offenses connected to the platform. Those are concrete actions, not merely stern PDFs with a shield icon, and they matter.

🌿 The Gentle Awakening

The significant change is speed. Business email compromise has always depended on understanding context: who reports to whom, who can approve invoices, which vendor names sound plausible, and what kind of panic will make a request feel normal. Historically, attackers had to spend time inside the mailbox conducting reconnaissance like grubby management consultants.

AI collapses that time. Microsoft’s warning, quoted by Ars, is the sentence every organization should print and tape somewhere near finance: once an inbox is compromised, criminals may understand its contents in minutes, not days.

This does not mean the robot is a criminal mastermind. It means the boring labor of fraud — sorting, summarizing, ranking, mapping relationships, drafting plausible messages — is becoming cheaper. The villain is not necessarily smarter. The villain has acquired admin support.

• Verify payment changes through a second trusted channel, not the same email thread currently being haunted.
• Monitor device-code flows and unusual OAuth grants, especially when they do not match expected user behavior.
• Use phishing-resistant authentication where possible, because “looks like Microsoft” is no longer a sufficient spiritual defense.
• Assume inbox compromise becomes intelligence compromise, not merely message access.

👑 The Gold-Leaf Reckoning

There is a vulgar elegance to the EvilTokens story. It takes existing weaknesses — social trust, device-code confusion, overworked finance teams, and the eternal human belief that official-looking pages are safe — then pours AI over them like champagne on a server rack.

The security lesson is not that every phishing email now contains artificial general intelligence in a trench coat. The lesson is that fraud platforms are becoming operationally luxurious. They reduce attacker effort. They package workflows. They monetize convenience. They bring the very worst parts of the software industry to crime: dashboards, subscriptions, automation, and the unbearable confidence of a product roadmap.

Organizations do not need to panic theatrically. They do need to update their assumptions. A stolen inbox is no longer just a mailbox. It is a corporate memory palace, and someone has handed the burglar a concierge bot.

“Your inbox has been analyzed for premium fraud opportunities; thank you for choosing enterprise negligence.” — The Slap of Wisdom Identity Access Spa, offering OAuth exfoliation with complimentary regret