Microsoft Dismantles EvilTokens AI Phishing Network That Targeted Corporate Inboxes

Microsoft announced it has dismantled the EvilTokens phishing network, a criminal operation that used artificial intelligence to analyze corporate email inboxes and identify high-value targets for fraud.

The network worked by gaining access to corporate email systems and using AI to scan inboxes for patterns that indicated financial authority, such as executives who approve wire transfers or vendors who handle large invoices. Once a target was identified, the network sent highly personalized phishing messages designed to trick recipients into transferring funds or revealing credentials.

Microsoft said EvilTokens represents a new class of AI-assisted cybercrime. Traditional phishing attacks send generic messages to large numbers of people. EvilTokens used AI to make each attack specific to the target, increasing the likelihood of success.

The company said the operation lowered the barrier to entry for sophisticated cybercrime. Attackers no longer need deep technical expertise to craft convincing, targeted fraud attempts. AI tools can do the analysis and personalization automatically.

Microsoft did not disclose the number of victims or the total financial losses attributed to EvilTokens. The company said it worked with law enforcement agencies in multiple countries to dismantle the network.

The takedown comes as agentic AI, which can perceive context and take actions autonomously, is becoming more widely available. Security researchers have warned that the same capabilities that make AI agents useful for productivity can be adapted for criminal purposes.

Microsoft said it is updating its security tools to detect AI-assisted phishing patterns. The company urged businesses to enable multi-factor authentication and to train employees to verify unusual financial requests through a second channel before acting.