Microsoft has disrupted EvilTokens, a powerful cybercrime platform that used AI at every step of the attack chain—from compromising email accounts to designing intricate roadmaps for financial fraud and scams. While EvilTokens helped cybercriminals access email accounts, at the center of the service was an AI-style chatbot that could analyze a victim’s inbox and help criminals identify trusted relationships, payment authorizations, and sensitive responsibilities, as well as other circumstances where fraud was most likely to succeed. The platform could even recommend fraud strategies, including drafting messages that impersonated trusted contacts to help criminals trick victims into taking action. 

In short, AI was not simply helping attackers write more convincing messages. It helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible.   

Within months of launching in February 2026, EvilTokens had been linked to more than 12,000 compromised email inboxes across over 10,000 organizations worldwide, showing how quickly the service gained traction. Microsoft observed the highest concentrations of victim activity in the United States, Canada, the United Kingdom, Australia, India, and France. Affected organizations ranged from wholesale distribution and construction to financial services, real estate, higher education, and healthcare. Working with partners, Microsoft seized 50 websites used to operate the service and disabled more than 150 additional domains tied to its supporting infrastructure. In the United Kingdom, the Metropolitan Police Service’s cybercrime team arrested two men on suspicion of offenses connected with the alleged operation of EvilTokens.  

But the significance of EvilTokens extends beyond its rapid growth and global reach. It offers an early warning of what happens when cybercriminals combine stolen access with AI capable of understanding how an organization works. 

From account access to financial fraud

EvilTokens helped criminals gain access to email accounts by tricking victims into entering an authentication code on Microsoft’s legitimate sign-in page. By completing the normal authentication sign-in process, victims unknowingly gave criminals access to their email accounts without revealing their passwords. That access could persist even after a password reset if the associated sessions and tokens were not also revoked. Microsoft Threat Intelligence provides additional technical details about the operation, how device-code attacks work, and steps customers can take to protect themselves here. 

Once inside an account, criminals have traditionally needed time and experience to sift through thousands of messages, identify decision-makers, understand payment processes, and find opportunities for fraud. 

EvilTokens began automating that work. Its AI tools could summarize and translate emails, surface financial conversations, map organizational roles, identify trusted relationships, and recommend potential targets. Preset prompts offered to find wire-transfer discussions, identify the organization’s “money movers,” locate vendor invoices, and determine the best people to impersonate.

The post Disrupting EvilTokens: The AI Chatbot Built for Cybercrime appeared first on Microsoft On the Issues.

As Americans prepare to vote this November, artificial intelligence is changing how many people find and understand election information. 

Some voters are deliberately turning to AI tools with questions about candidates, ballot measures, election procedures, and issues that matter to their communities. Others are encountering AI-generated summaries at the top of search results. In either case, AI is increasingly becoming a front door to election information. 

This shift is happening quickly. More than 30% of the U.S. working-age population now uses AI (Microsoft AI Diffusion Index, Q1 2026; Microsoft, AI Adoption Across the United States). These tools can help people understand complicated topics, compare information, and explore unfamiliar issues. But election information can also present some challenges for AI. It is highly local, changes quickly, and can be incomplete, contested, or stripped of essential context. 

The answer is not to steer voters away from AI, it is to help people use it wisely, particularly when the information may influence aspects of their voting experience, such as how, when, and where they cast their ballot. 

That is why, on National Voter Registration Day, a day when our brands and products come together to encourage civic participation, we’re launching the next phase of our voter education initiative, Check. Recheck. Vote. This year, the campaign will equip voters with practical AI literacy skills for the 2026 election season.  

Check. Recheck. Vote.

We launched Check. Recheck. Vote. in 2024 to help voters recognize the risks posed by deceptive AI-generated content. Deepfakes and other deceptive media remain a serious concern. But in conversations with voters and election organizations, we are also hearing about a broader and more immediate challenge. Millions of people now encounter election information through AI-generated answers, and many are not sure how to determine whether those answers are current, complete, or reliable. 

The updated campaign gives voters three straightforward steps: 

• Check the sources and citations behind an AI-generated answer. Look for where the information came from, who published it, and when it was last updated. Be cautious when an answer provides no sources. 

• Recheck important details by visiting the original sources and comparing what other credible sources say. This is especially important for fast-changing or location-specific information. 

• Vote based on current information from your state or local election website, including official guidance on registration, voting options, deadlines, and polling locations. 

At the center of the campaign is a new 75-second video that shows how an AI-generated answer can appear during an ordinary election-related search, explains where these answers can fall short, and offers simple steps voters can take before relying on them. 

The campaign website pairs the video with practical guidance and links to authoritative election resources, including state-by-state voting information and tools for educators.  

We are working with the National Association of Secretaries of State (NASS) and the National Association of State Election Directors (NASED) to scale the reach of this campaign across all fifty states and the territories and to point voters to accurate information directly from state and local election officials so they can participate with confidence. 

We believe that civics and voter education start well before a citizen is old enough to vote. That’s why we are also investing in efforts to extend AI voter literacy education in the classroom. The campaign website includes a classroom activity to help students examine how AI may shape the election information they encounter, practice verifying claims, and keep their own judgment at the center of the process. We are also amplifying our impact on this important issue by supporting the News Literacy Project. 

We’re also proud to announce today that, in partnership with iCivics, we are launching Village Square – a new Minecraft Education civic learning experience that helps students explore how communities make decisions and solve shared challenges. The game brings concepts such as dialogue, participation, and collective decision-making to life through immersive gameplay. Village Square gives educators and families an engaging, nonpartisan way to help young people practice listening to different perspectives, weighing trade-offs and working together to build stronger communities. 

Finally, we know that credible local reporting remains essential to informed civic participation, and that reporting is under strain in many communities. 

In Washington state, Microsoft is partnering with the Associated Press Fund for Journalism to expand election coverage for 10 local newsrooms operating 14 news websites. Participating newsrooms receive access to AP election results and race calls, vote tabulations, state-specific maps and graphics, and resources that help local journalists connect national and statewide developments to the communities they serve. 

The newsrooms represent communities from Seattle to Spokane and the Wenatchee Valley. Their work complements the reporting of the Associated Press, helping trusted, fact-based election coverage and results reach communities that might otherwise lack access. 

This investment reflects a broader reality. Voters need more than information. They need reliable sources that can provide context, ask hard questions, correct mistakes, and explain what national developments mean at the local level. 

Microsoft’s Support for the 2026 Midterms

Voters aren’t the only ones navigating this AI moment, so are the people running campaigns and conducting elections, all while facing an increasingly complex cybersecurity landscape. Microsoft has long supported the security and resilience of campaigns and elections. In 2018, we launched AccountGuard to help political campaigns and democracy-focused organizations defend against cyberattacks, and during the 2024 election cycle we joined dozens of other technology companies in the Tech Accord to Combat Deceptive Use of AI in 2024 Elections. Here’s how that commitment continues today: 

Equipping election officials. With The Elections Group, International IDEA, Ready for Tuesday and Arizona State University’s Mechanics of Democracy Lab, we launched the free, open-source AI + Elections Skills Hub: prompts, sample AI agents, and draft policies for responsible adoption. It’s already reached 1,000+ officials across 45 states. 

Strengthening cybersecurity. We’ve deployed Microsoft Sentinel to several state and local election offices for stronger threat detection, and we’re also supporting select election and political stakeholders with MDASH to find and fix software vulnerabilities faster. 

Countering bomb hoaxes. More than 300 emailed bomb hoaxes disrupted polling places in 2024. In response, we’ve started a new Elections Bomb Threats Task Force alongside partners Social Scout, Nisos, and the Committee for Safe and Secure Elections (CSSE) to bring together digital intelligence and law enforcement expertise to track & share trends and reduce disruptions. An initial report on the hoaxes encountered in 2024 will shape our approach for 2026. 

Supporting campaigns. Built with Defending Digital Campaigns, our Secure AI Toolkit for Campaigns has reached 3,000+ campaigns and political stakeholders with practical AI guardrails. Our Campaign Technology team has also trained thousands of candidates, staff, and officials from both parties on responsible AI use and cybersecurity best practices. 

The technology continues to change, but our approach remains consistent: help voters find authoritative information and make informed judgments, help campaigns and election authorities defend against evolving threats, and help the election community adopt technology that strengthens security, accountability, and civic participation. This work is bipartisan by design, and it includes: 

• Azure for Elections – prioritized support and security for elections-critical cloud workloads 

• M365 for Campaigns – secure, cost-effective collaboration and email for candidates and campaigns 

• Deceptive AI in Elections Reporting – malicious deepfakes of candidates and election officials are disallowed on Microsoft platforms, and targeted individuals can report them directly 

• Content Provenance – Microsoft image generation products affix content provenance to images, with LinkedIn displaying that provenance to users 

• Civic engagement – continuing our long-standing work to promote civic engagement through our own products and partnerships 

The 2026 election will be the first U.S. federal election in which generative AI is part of the everyday environment for millions of voters as well as those who support the political process. That creates new risks, but it also gives us an opportunity to equip people with skills that will remain valuable well beyond a single election. 

The post 2026 midterm elections: Helping voters navigate election information in the age of AI appeared first on Microsoft On the Issues.