Evil Tokens and the AI Money Mover Hunt | 2 Minute Drill with Drex DeFord
You've seen it: a smart TV, a printer, or a conference-room screen gives you a short code and sends you to a Microsoft page on your phone. That handoff is called a device code sign-in, and for about six months this year it was the front door for one of the busiest criminal businesses on the internet. Steve Masada runs Microsoft's Digital Crimes Unit, the team that sues criminals and then, with a court order, takes down their infrastructure. They had done it 39 times before. Number 40 was Evil Tokens.
Evil Tokens launched in February on Telegram and ran like a software company: $1,500 to sign up, $500 a month after that, a help desk, management dashboards, and 44 kinds of phishing email to pick from. It also came with an AI bot. Once a customer was inside a company's email, the bot read the inboxes with preset prompts: find the wire transfer conversations, find the vendor invoices, figure out who the money movers are, who they trust, and who to pretend to be. Masada says AI was not simply helping attackers write more convincing messages. It was helping them decide who to target and who to impersonate. Drex says more than 12,000 inboxes across more than 10,000 organizations were involved, mostly in the US, Canada, the UK, Australia, India, and France, and investigators say a big chunk of the infrastructure had been vibe coded.
Microsoft tipped off London's Metropolitan Police in August. On September 11, officers arrested two men, aged 32 and 38, on suspicion of fraud and money laundering. They are out on bail while the investigation continues. On September 22, a US federal court let Microsoft seize 50 websites in more than 150 domains. The co-plaintiff on that lawsuit was Health ISAC, and healthcare was on the target list. Health systems pay vendors all day, and those payments live in somebody's inbox. The fake request to change a vendor's bank account can now come from the right person, about the right invoice, in the right tone, at the right time. Drex's rules: call back on a number you already know before any bank change, and get two people on every large wire transfer.
Remember, Stay a Little Paranoid.
More episodes from "UnHack with Drex DeFord"
Don't miss an episode of “UnHack with Drex DeFord” and subscribe to it in the GetPodcast app.
