Two arrested in UK after Microsoft takedown of ‘Eviltokens’ AI-chatbot for cybercriminals
Microsoft's court-authorized takedown of the EvilTokens AI phishing platform led to two UK arrests; the service had access to 12,000+ compromised inboxes.
Microsoft's Digital Crimes Unit, partnering with Health-ISAC and OpenAI, used a US court order to dismantle EvilTokens, a Telegram-sold AI chatbot service ($1,500 initiation plus $500 monthly) that automated phishing, inbox analysis and fraud targeting. UK Metropolitan Police arrested two men, aged 32 and 38, who were released on bail; Microsoft seized 50 websites and disabled 150 domains. EvilTokens launched in February 2026 and was linked to more than 12,000 compromised inboxes across 10,000+ organizations, concentrated in the US, Canada, UK, Australia, India and France. Its device code phishing flow let criminals hijack sessions on devices that cannot support standard sign-in methods.
- Two alleged EvilTokens operators arrested in UK, released on bail
- Service linked to 12,000+ compromised inboxes across 10,000+ organizations
- Device code phishing bypassed passwords and persisted after password changes
- 50 websites seized and 150 domains disabled in the takedown
From the original article
4 min read at therecord.mediaAvailable on Telegram for a $1,500 initiation fee and a recurring monthly $500 subscription, EvilTokens provided cybercriminals with artificial intelligence tools enabling them to compromise accounts, analyze breached inboxes and find the best methods for monetizing their access through fraud.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.