Microsoft Dismantles AI‑Driven Scam That Breached 12,000 Accounts

Microsoft led an industry-wide takedown of EvilTokens, an AI-assisted platform that automated mass email compromises, using a device-code OAuth workflow to hijack Microsoft accounts and identify high‑value targets. The service compromised about 12,000 accounts across 10,000 organizations before authorities seized 50 sites and 150 domains and the UK arrested two men. The incident underscores the need for strong identity protections and independent verification of payment-change requests.