Microsoft disrupts AI-enabled cybercrime platform EvilTokens

At a glance

Microsoft says the operation used AI to analyze compromised inboxes, identify trusted payment relationships, and help criminals prepare fraud. Microsoft linked it to more than 12,000 compromised inboxes across 10,000+ organizations. Why it matters: Protect email with MFA, monitoring, and verification procedures for payment or banking changes.

What this means for Miami businesses

The EvilTokens story is a reminder that an inbox is not just a place where messages arrive. It is a doorway into payment workflows, supplier relationships, password resets and trusted conversations. When attackers gain access to email, even an ordinary-looking request can carry the credibility of a real business relationship. For a Miami-area business, the practical risk is operational: a fraudulent banking change, invoice diversion, or account takeover can disrupt cash flow and consume hours of recovery work. Treat unusual payment instructions as a separate verification event. Call a known number already on file; do not rely on a phone number included in the message. Require more than one person to approve sensitive changes where practical.

Practical next steps

Review multi-factor authentication, mailbox forwarding rules, sign-in alerts, privileged accounts, and finance-team verification steps. A security stack can help detect suspicious activity, but written procedures and staff awareness matter too. The aim is layered prevention and a reliable response path—not a promise that one product will stop every fraud attempt.

How CG Networks can help

CG Networks can assess email, identity, endpoint and backup controls together as part of a practical cybersecurity plan.

Read the original update from Microsoft Digital Crimes Unit. This article combines the linked source material with original analysis from CG Networks; verify current product availability and details with the vendor.

Talk with CG Networks

Back to the CG Networks Blog

Why inbox security belongs in business continuity

Email is often connected to many other services, so an incident can have effects beyond one mailbox. Organizations should know how an employee reports a suspicious sign-in, who can disable a compromised account, how sessions are revoked, and how critical messages are preserved for investigation. Finance and operations teams should document an independent verification route for changes to bank details, payment instructions, vendor contacts, and other high-impact requests. The control should be simple enough to follow under deadline pressure.

A practical tabletop exercise can test the process without staging a real attack. Ask how staff would respond to a convincing message from a known supplier, who approves an account change, and what evidence is retained. The answers can expose gaps in procedures and escalation paths before a real incident occurs.

Operational details worth checking

For incident planning, also check whether the company can quickly locate the affected account, identify connected devices and revoke access to active sessions. Confirm that a recovery contact and escalation route are documented outside the potentially compromised mailbox. Security reviews should consider the process end to end, from employee reporting through containment and follow-up. These steps help turn an alert into a repeatable response rather than an improvised scramble.