Microsoft Disrupts AI-Assisted Hacking Platform Linked to 12,000 Account Compromises

Microsoft says it has disrupted an AI-assisted hacking platform that was used to compromise roughly 12,000 accounts, describing the service as an end-to-end tool that simplified large-scale account takeovers for attackers.

The platform, identified as EvilTokens, reportedly provided users with a streamlined way to conduct mass account compromises, according to Microsoft. The company characterized the service as notable for integrating AI-assisted capabilities that made the process faster and more accessible than earlier hacking tools.

How the Platform Operated

Details about the platform's exact technical methods were not fully outlined in the available information, though Microsoft's characterization suggests the service automated significant portions of the account-compromise process, reducing the technical expertise needed by individual attackers to carry out large-scale intrusions.

Microsoft's disruption effort targeted the infrastructure behind EvilTokens, though the company did not specify in the available details how many individuals or groups were affected by the takedown, or what legal actions, if any, have been pursued against operators of the platform.

The case adds to a growing list of AI-assisted cybercrime tools that technology companies have moved to disrupt in recent years, as generative and automated AI tools have increasingly been adapted by attackers to scale operations that previously required more manual effort.

Microsoft has periodically published findings on such disruptions as part of its broader digital crimes and threat intelligence efforts. It was not immediately clear whether affected account holders have been notified individually or what remediation steps, if any, are being offered to those whose accounts were compromised.