AI email fraud is becoming more dangerous because attackers no longer need to read a hacked inbox one message at a time.
Microsoft’s Digital Crimes Unit recently disrupted a cybercrime platform called EvilTokens. According to Microsoft, the service combined email-account compromise with an AI-style chatbot that could analyze a victim’s inbox and identify trusted relationships, payment authorizations, sensitive responsibilities, and other details useful for fraud.
The AI was not simply polishing phishing emails.
It could help criminals answer more valuable questions:
- Who approves payments?
- Which vendors does the company trust?
- Who handles payroll?
- Which executive could be impersonated?
- What kind of request would look normal?
For a small business, that changes the meaning of an email-account compromise.
A hacked inbox is not only a mailbox. It can become a map of how your business moves money and trust.
What Was EvilTokens?
Microsoft described EvilTokens as a cybercrime platform that used AI across multiple stages of an attack.
The platform helped criminals compromise email accounts and then analyze the information inside them. Its chatbot could identify relationships and responsibilities that made certain people or conversations more useful for fraud.
Microsoft said the platform could also recommend fraud strategies and draft messages that impersonated trusted contacts.
This matters because traditional business email compromise often requires patience. An attacker may spend days or weeks reading messages and learning how a company works before sending a fraudulent request.
AI can reduce that research time.
Your Inbox Contains More Business Intelligence Than You Think
Consider what an employee mailbox can reveal.
Even without opening attachments, an attacker may learn:
- The names of customers and vendors
- Who reports to whom
- Who approves invoices
- Which accounting firm the company uses
- When payroll runs
- Which suppliers expect ACH payments
- Who travels frequently
- Which employee handles urgent requests
- How executives normally write
That information can help an attacker create a scam that fits the company’s normal workflow.
A generic phishing email may say, “Please pay this invoice.”
An inbox-informed attack might say, “Please send the revised ACH payment for the Hill Country project before the vendor cutoff. Sarah already approved the change.”
The second message is more dangerous because it sounds like something that could actually happen inside the business.
AI Does Not Need to Invent the Scam
One of the most important lessons from EvilTokens is that AI does not need a new hacking technique to increase risk.
It can make old fraud methods faster and more targeted.
Business email compromise already works by abusing trust. AI can help attackers understand that trust structure more quickly.
It can identify:
- The best person to impersonate
- The most believable payment amount
- The right vendor name
- The tone used by the executive
- The best time to send the request
That makes employee awareness more important, but training alone is not enough.
Protect the Email Account First
The strongest fraud message is much harder to build if the attacker never gets into the mailbox.
Small businesses should start with identity security.
Use unique passwords for every business account. Store them in a business password manager such as 1Password instead of browsers, spreadsheets, or shared documents.
Enable MFA or passkeys wherever practical.
Remove old accounts quickly when employees leave.
Review administrator privileges and avoid giving employees more access than they need.
Password-first security matters because one reused or stolen credential can open the door to email, cloud storage, CRM systems, and other business tools.
A Password Change May Not Be the Entire Response
If an email account is compromised, changing the password is important.
However, the business should also consider what the attacker may have changed while inside.
Review:
- Recent sign-ins
- Active sessions
- MFA methods
- Inbox rules
- Forwarding settings
- Connected applications
- Administrator changes
An attacker may create forwarding rules or retain an active session even after the employee believes the problem has been fixed.
Account recovery should restore trust, not simply create a new password.
Payment Verification Has to Move Outside Email
If email is the source of the request, email should not be the only way you verify it.
This is especially important for:
- New bank details
- Wire transfers
- Large ACH payments
- New vendors
- Urgent executive requests
- Changes to payroll information
Use a second trusted channel.
Call a known phone number. Speak to the owner in person. Use an established Teams account. Follow the company’s documented approval process.
Do not reply to the suspicious email and ask, “Did you really send this?”
If the attacker controls the mailbox, they can answer.
Employees Need a Simple Rule
A security policy should be easy to follow under pressure.
A practical rule is:
Any request that changes where money goes must be verified outside the message that requested the change.
That rule does not require employees to recognize every new AI scam.
It creates a process that still works when the message looks perfect.
Watch for Small Changes in Normal Conversations
AI-assisted fraud may not begin with an obviously suspicious email.
Attackers can insert themselves into existing conversations or imitate familiar contacts.
Employees should pay extra attention when a normal conversation suddenly includes:
- A new payment account
- An unusual sense of urgency
- A request to keep the transaction confidential
- A different reply-to address
- A new attachment
- A request to bypass the normal approval process
The red flag may be the change in business process, not the grammar.
What Should a Small Business Do This Week?
- Review email MFA. Make sure business accounts use stronger authentication.
- Move passwords into a business password manager. Stop password reuse and informal sharing.
- Create a payment-verification rule. Require a second channel for high-risk changes.
- Review forwarding and inbox rules. Look for unexpected settings.
- Remove old accounts. Former employees and unused administrators should not remain active.
- Train employees around process changes. Teach them to verify unusual payment instructions, not just spelling mistakes.
Frequently Asked Questions
EvilTokens was a cybercrime platform disrupted by Microsoft. Microsoft said it combined email compromise with an AI-style chatbot that could analyze inboxes, identify trusted relationships and payment responsibilities, and help criminals design fraud strategies.
Microsoft described AI being used throughout the attack chain, but the most important small-business lesson is the chatbot’s ability to analyze already-compromised inboxes and help criminals plan more convincing fraud.
Business email contains conversations, vendor relationships, payment patterns, executive names, approval processes, and other information that can make impersonation scams much more believable.
MFA can reduce account-takeover risk, but no single control prevents every attack. Businesses also need strong passwords, session review, email monitoring, and payment-verification procedures.
Reset affected credentials, revoke suspicious sessions, review MFA methods, check forwarding and inbox rules, review connected applications, inspect sign-in activity, and determine whether sensitive information or payment processes were exposed.
Your Inbox Is Part of Your Payment Security
EvilTokens shows why businesses can no longer treat email compromise as a simple password problem.
Once attackers gain access, AI can help them understand who matters, how money moves, and which trusted relationship gives them the best chance of succeeding.
SofTouch Systems helps small Texas businesses protect email, passwords, endpoints, and everyday business processes with practical security that employees can actually follow.
If you are unsure whether your email accounts and payment-verification procedures would stand up to a targeted fraud attempt, start with a free 15-minute IT security check.
Protect the inbox. Verify the payment. Do not give attackers an easy map of your business.
Sources:
Discover more from SofTouch Systems
Subscribe to get the latest posts sent to your email.