Microsoft reports EvilTokens using AI to tailor phishing messages and identify valuable targets inside compromised email accounts.
Source: Microsoft Threat IntelligenceRelated compromises were first observed February 19; early AI involvement was inferred. Huntress published March 20 and named EvilTokens March 23. Microsoft expanded the account September 22.
AI helped tailor deceptive emails to a person’s work.
Microsoft Defender Security ResearchThe victim approved the attacker’s session on a real sign-in page.
Microsoft Digital Crimes UnitAI helped identify people and payment conversations worth targeting.
Microsoft Digital Crimes UnitMicrosoft observed stolen emails and rules hiding further activity.
Microsoft Threat IntelligenceEditorial analogy: a convincing caller asks you to approve a spare office key. The key desk is legitimate, but the key goes to the caller. A helper then reads the filing cabinet to learn who can authorize payments.
An analogy for the mechanism; not an additional claim about the incident.Microsoft observed email theft and AI-assisted selection of financial or executive targets. Microsoft Threat Intelligence
The totals cover the service, not losses proved to result from AI.
No total financial loss is established in the reviewed accounts.
Several customers used this criminal service; we group its connected operations.
Editorial lesson: a familiar sign-in page does not establish who will receive access. Tie approval to the action you initiated, independently verify unusual payment requests and investigate suspicious sessions alongside changes inside mailboxes.
People operated the service and chose how to use its recommendations. Microsoft Digital Crimes Unit
Microsoft reports infrastructure disruption, customer notification and help securing compromised accounts. Microsoft Digital Crimes Unit
Editorial connections for organizations protecting their staff, identities and email. Relevant controls do not prove any product would have prevented this campaign.
Train staff to question unexpected code approvals and independently verify payment changes through a known contact. Inspect the requested access, not just the page branding.
Persuasive messages can still fool careful people. Training needs technical access restrictions and a reporting path.
Allow device-code sign-in only where the business needs it and narrowly scope exceptions. Review unfamiliar devices and active sessions, then contain compromised access.
Passwords and routine MFA alone do not prevent a person approving an attacker’s session. Revocation behavior needs to be checked across affected services.
Investigate new forwarding or hiding rules, unusual email exports and unexpected device registration together. Revoke illicit access.
A successful login alone does not explain intent, and stopping future access cannot undo data already stolen.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkExplore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Read this case’s update history →
Reviewed Sep 23, 2026 · Editorial methodology · Structured data