A compromised mailbox has always been dangerous. What has changed is the speed at which criminals can turn access into a convincing payment fraud. Microsoft’s disruption of EvilTokens offers a useful warning for growing companies: an attacker no longer needs days of patient reading to understand who approves payments, which suppliers are trusted, or how executives communicate. AI can help map those relationships in minutes.
What happened
Microsoft’s Digital Crimes Unit said it disrupted EvilTokens, a cybercrime platform that combined account compromise, mailbox analysis, target selection and fraud preparation. According to Microsoft, the service was linked to more than 12,000 compromised inboxes across over 10,000 organisations after launching in February 2026. Microsoft and partners seized 50 websites and disabled more than 150 related domains. UK police also arrested two people on suspicion of offences connected to the alleged operation; the investigation remains ongoing.
The platform reportedly used device-code phishing. Victims entered an authentication code on Microsoft’s legitimate sign-in page, unknowingly authorising access. That detail matters because a familiar domain and multi-factor authentication prompt did not make the action safe. Once access was obtained, the service could analyse messages, identify financial conversations, locate invoices, map roles and suggest whom to impersonate.
Microsoft’s account is a report from the company that led the disruption, and some allegations remain subject to investigation. Even with that limitation, the defensive lesson is concrete: stolen cloud sessions and business context can now be packaged into a repeatable fraud service.
Why this matters for growing businesses
Small and midsize firms often rely on informal trust. A finance colleague recognises a director’s writing style. A supplier normally sends bank details by email. A manager approves an urgent payment from a phone. Those habits were fragile before generative AI. They are more fragile when an attacker can search years of correspondence, imitate internal language and choose a moment when the usual approver is travelling.
A password reset is not necessarily sufficient after token theft. Active sessions, application consents and refresh tokens may remain valid unless they are explicitly revoked. Meanwhile, an attacker may have created inbox rules, registered another authentication method or copied sensitive threads. Treating the event as a simple password problem can leave the door half open.
The accounting process is part of the security perimeter. If bank-detail changes, unusual payments and invoice approvals are controlled only inside email, identity security alone cannot carry the whole burden. The strongest response combines technical controls with a payment process that assumes email can be compromised.
Five controls to implement now
- Harden sign-in and session policy. Require phishing-resistant authentication for administrators, finance staff and executives where practical. Use conditional access, block legacy authentication and alert on unusual device-code sign-ins. Ensure the incident playbook includes revoking sessions and tokens, not only changing the password.
- Verify money movement out of band. Any new beneficiary, bank-detail change or unusual payment should be confirmed through a trusted second channel. Call a known number from the ERP or supplier master record, not a number supplied in the suspicious message.
- Separate request, approval and release. One person should not be able to change supplier details and release the related payment. Configure approval thresholds in the ERP and require a second approver for exceptions. Controls belong in workflow logic, not in a policy document nobody opens during a busy Friday afternoon.
- Monitor mailbox persistence. After suspected compromise, review inbox rules, forwarding addresses, delegated access, registered devices, authentication methods, OAuth application grants and sign-in history. Preserve evidence before deleting it.
- Run a realistic exercise. Test an urgent bank-detail change involving a known supplier and a senior executive. Measure whether staff use the approved verification route and whether finance can stop the payment without searching for a manager who is unavailable.
A practical 30-day plan
During week one, identify accounts that can request, approve or release payments. Confirm that each has strong authentication and a named owner. In week two, document the bank-change process and remove email-only approval. In week three, configure alerts for risky sign-ins, forwarding rules and unusual consent grants. In week four, run a tabletop exercise covering detection, session revocation, supplier contact, payment recall, legal escalation and customer communication.
Track a small set of measures: percentage of privileged accounts using phishing-resistant authentication, time to revoke all sessions, percentage of supplier changes independently verified, and number of payment exceptions bypassing the normal workflow. A control that cannot be observed tends to become theatre.
How VDS Consultoria can help
VDS Consultoria can map the identity-to-payment attack path across Microsoft 365, Odoo and banking procedures. We help define approval rules, harden account configuration, connect alerts to an incident workflow and test the process with finance and management. The goal is not another security binder. It is a working chain of controls that still holds when a message looks authentic and the request feels urgent.