Microsoft says that there has been a coordinated cyber attack on over 12,000 Microsoft accounts in more than 10,000 organizations globally through the use of artificial intelligence chatbots. As per reports from the company, the cyberattacks were executed for a few consecutive months using an evil AI chatbot that was available on a certain platform named “EvilTokens.” The AI chatbot was used for extracting information from emails after hacking into the accounts and developing very convincing phishing emails.
The “EvilTokens” system became known first through a Telegram channel, in which the cybercriminals had been offered to have access to the malicious software for a starting price of $1,500, as well as a subscription of $500 per month. As explained by Microsoft, EvilTokens was an all-round service allowing cybercriminals to carry out actions from hacking email accounts to making fraud money transactions.
After gaining access to the victim’s account, the system analyzed all messages in the inbox to find critical contacts and business correspondence. The AI chatbot integrated into the system used this information to compose believable phishing emails, pretending to be the trusted sender.
Based on the findings of Microsoft, apart from writing messages that appear to be fraudulent, AI was also used extensively for target identification and creation of pseudonyms and false personas for the purpose of entrapment through the use of professional links of the targeted victims. The worst sufferers of such organized EvilToken attacks were corporate organizations in the US, Canada, the UK, Australia, India, and France.
Microsoft has confirmed that to dismantle the malicious "EvilTokens" network, approximately 50 websites associated with the platform and more than 150 related infrastructure domains have been seized and taken offline. In addition, the UK Metropolitan Police Cyber Crime Unit has arrested two suspects over their alleged involvement in the platform's illicit operations within the country.
