Microsoft dismantles EvilTokens, the AI shop selling inbox break-ins
Microsoft spent Tuesday taking apart a criminal subscription service that turned business-email compromise into a product. The takedown is one paragraph; the numbers behind it are the story.
Microsoft says it led an industry-wide disruption of EvilTokens, a phishing platform that used an AI chatbot to compromise 12,000 Microsoft accounts over a few months. The service launched on Telegram in February at $1,500 up front plus $500 a month, and it did not sell a phishing kit so much as the whole back office. It sent the spam, ran a hidden script that walked the victim through Microsoft's device-code sign-in flow to enroll an attacker-controlled device, then read the resulting inbox with a model — ranking employees who could move large sums, working out who they reported to, and drafting the follow-up email that would make a payment look routine. Microsoft seized 50 websites and 150 more domains with help from a network of partners, and the UK's Metropolitan Police arrested two men.
Two details explain why this takedown matters more than the average seizure. SpyCloud, which contributed recaptured data on more than 8,700 victims, notes that the tokens EvilTokens harvested outlive a password reset: refresh tokens carry a 90-day inactivity window with no fixed maximum age, and any MFA method or device registration the attacker added along the way survives untouched. The platform's economics were also deliberately narrow — across its 12 highest-volume customers, 74 percent of victims came from a single country on average, which is what targeted campaigns look like rather than opportunistic spray.
Sekoia, which reverse-engineered an affiliate's copy of the kit, describes the AI layer as two prompts: one that mines a batch of stolen mail for financial exposure and thread-hijack openings ranked by dollar impact, and one that turns the top three into concrete fraud scenarios. Microsoft's own guidance is the tell — assume that once an inbox is compromised, criminals may understand its contents in minutes, not days. We covered the same shift in September, when Google's threat team documented an attacker who went from cloud foothold to mass credential theft in under six hours — Attackers built an AI agent that stole credentials in six hours.
Jane Street has published a scaling study that undercuts how most labs tune their training data. The firm trained in-house dense and mixture-of-experts models from tens of millions to hundreds of billions of parameters, plus the open-weight Qwen 2.5 family, assigning random weights to individual training sequences and measuring how much of each sequence's loss reduction tracked its weight. The result is not a smooth curve: small models learned patterns across the whole dataset regardless of weight, medium models learned in proportion to weight, and the largest models went back to learning everything regardless of weight. Epoching shifts that peak toward smaller models.
A non-monotonic curve is a direct problem for the standard practice of fitting data-mix hyperparameters on small runs and extrapolating upward. The paper's framing is that small-scale behaviour does not cleanly predict the largest scales — it cites a case where a code-heavy and a STEM-heavy mix swapped rankings as models grew — and its practical advice is unglamorous: extrapolate data-mix results only from sufficiently large models, or adjust the weights to compensate for the measured exponent.
What to watch: whether a second EvilTokens-style platform appears now that an affiliate's source code has been public, and whether other labs publish data-mixing results that contradict their own small-scale sweeps.
If a stolen session token can survive a password reset, is "reset everything" still a remediation plan? Tell us in the comments.
Sources: Microsoft On the Issues · Ars Technica · SpyCloud · Sekoia · Jane Street · Hacker News discussion
