The Scam Platform That Sold Inbox Hijacking by Subscription
Microsoft says it led an industry-wide disruption of a subscription-based scam platform that used an AI chatbot to compromise 12,000 Microsoft accounts over a few-month span, Ars Technica reports. The platform was called EvilTokens, and what it sold was more than credentials: according to Microsoft's account, it could recommend fraud strategies, including drafting messages that impersonated trusted contacts to trick victims into taking action. The automation sat on the social-engineering step rather than the login.
AI-generated discussion · Different perspectives
The business model is the striking part. EvilTokens charged an initial $1,500 fee and then a recurring $500 a month — fraud sold as a subscription.
Subscriptions only make sense if the work repeats. The platform helped customers read inboxes, pick the targets worth the effort, and draft follow-up emails that got employees to move money.
Packaging is the point. A single service that streamlines most of the steps needed to compromise email accounts in large numbers is what turns a skill into a product.