Microsoft shuts down EvilTokens AI platform that compromised 12,000 accounts

EvilTokens, a known cyber‑threat actor, has recently introduced an end‑to‑end platform designed to accelerate and simplify mass compromise operations. The toolchain bundles several attack components—credential harvesting, lateral movement, persistence, and data exfiltration—into a single, user‑friendly package that can be deployed by operators with limited technical expertise.

Security researchers have documented the platform’s use in a series of recent intrusions targeting corporate networks across multiple industries. Distributed through underground forums and dark‑web marketplaces, the tool lowers the barrier to entry for threat actors, allowing them to conduct large‑scale attacks more efficiently than before. Analysts note that the modular design also facilitates rapid adaptation to defensive countermeasures.

Law‑enforcement agencies and cybersecurity firms are monitoring the spread of EvilTokens’ platform and urging organizations to review and harden their security postures. The emergence of such turnkey solutions highlights the escalating sophistication and accessibility of advanced persistent threat capabilities in the current threat landscape.