> ## Content Index
> Fetch the complete content index at: https://www.ai-360.online/llms.txt
> Use this file to discover other available public pages before exploring further.

# Microsoft takedown exposes the business model behind AI enabled account theft
- URL: https://www.ai-360.online/microsoft-takedown-exposes-the-business-model-behind-ai-enabled-account-theft/
- Published: 2026-09-23T04:52:00.000Z
- Updated: 2026-10-31T21:52:48.000Z
- Description: Microsoft disrupted EvilTokens, a service that paired inbox takeover with an AI chatbot that picked fraud targets, after more than 12,000 inboxes were hit.
- Author: AI-360
- Tags: 2. Security, 2. Fraud & Identity, News, Security, Enterprise AI

[Microsoft](https://www.microsoft.com/?ref=ai-360.online) has disrupted EvilTokens, a cybercrime service that combined email account takeover with an AI chatbot that analysed victims' inboxes and suggested who to target and impersonate, [the company said on 22 September 2026](https://blogs.microsoft.com/on-the-issues/2026/09/22/disrupting-eviltokens-the-ai-chatbot-built-for-cybercrime/?ref=ai-360.online).

Within months of launching in February 2026, EvilTokens had been linked to more than 12,000 compromised inboxes across over 10,000 organisations, [Microsoft](https://www.ai-360.online/microsoft/) said. Victims were tricked into entering an authentication code on Microsoft's legitimate sign-in page, which handed over account access without revealing a password. That access could persist after a password reset if sessions and tokens were not revoked.

The service was sold through Telegram for a $1,500 initiation fee and a $500 recurring subscription. Its AI tools could summarise emails, surface wire-transfer discussions, map roles and identify the best people to impersonate. Microsoft said investigators found evidence that large parts of the platform had been vibe coded and drew on several AI models.

With authorisation from the US District Court for the Eastern District of Virginia, Microsoft and co-plaintiff Health-ISAC worked with partners including Cloudflare, Coinbase, [OpenAI](https://www.ai-360.online/openai/) and TRM Labs. Microsoft seized 50 websites and disabled more than 150 additional domains. It is the Digital Crimes Unit's 40th court-authorised disruption and its first against an end-to-end AI-enabled cybercrime service.

Microsoft's advice is to assume criminals may understand a compromised inbox in minutes, and to verify payment-change and unusual transaction requests through a trusted second channel.

---