Microsoft, in collaboration with security firm SpyCloud and international law enforcement, has disrupted "EvilTokens," a subscription-based scam platform that utilized AI-driven automation to compromise 12,000 Microsoft accounts across 10,000 global organizations. Operating via Telegram since February, the platform charged a $1,500 setup fee plus $500 monthly recurring costs. The core of the service was an AI-style chatbot designed to automate complex social engineering tasks. This chatbot analyzed victim inboxes to identify high-value targets, such as individuals with payment authorization responsibilities or established trusted relationships, and subsequently drafted sophisticated impersonation messages to facilitate fraudulent fund transfers. The platform leveraged the OAuth device code authentication method—a legitimate process intended for input-constrained devices—to bypass standard login security and gain unauthorized access. The campaign impacted diverse sectors, including finance, healthcare, and higher education, with the highest victim concentrations in the United States, followed by Canada, the UK, Australia, India, and France. The disruption operation resulted in the seizure of 50 websites and 150 domains, alongside the arrest of two suspects by the UK’s Metropolitan Police Service.