Security News

Microsoft and UK Police Dismantle AI-Powered 'EvilTokens' Cybercrime Platform

The Record · 23 Sept 2026

Key Takeaway As criminals increasingly use AI tools to automate phishing and account takeovers, Australian small businesses should strengthen email security, enable multi-factor authentication, and train staff to recognise increasingly sophisticated phishing attempts.

Microsoft has taken down EvilTokens, an AI-powered platform sold to cybercriminals on Telegram for a $1,500 setup fee plus a $500 monthly subscription. The tool used artificial intelligence to help attackers compromise accounts, analyse stolen inboxes and identify the best ways to turn stolen access into fraud profits.

Microsoft's Digital Crimes Unit partnered with health sector non-profit Health-ISAC to secure a US court order allowing them to dismantle the platform and its supporting infrastructure. The company also worked with the UK's Metropolitan Police Service, whose cybercrime officers arrested two men, aged 32 and 38, following warrants carried out at two locations. Both have been released on bail while the investigation continues, and police believe others may have helped run the service.

Microsoft said EvilTokens stood out because it automated multiple stages of a criminal's workflow using capabilities drawn from several AI models, with OpenAI assisting in the disruption effort. The Metropolitan Police first received a report about the service from Microsoft in August, and investigators say phishing services like this cause widespread financial harm to victims worldwide.

phishing AI-crime Microsoft law-enforcement account-takeover

Summarised by CISO AI from The Record. We link back to every original so you can read it yourself.