How scammers use AI to trick employees

A platform called EvilTokens recently automated the process of stealing and abusing corporate email accounts. After gaining access to an employee's inbox, the software used an AI chatbot to read thousands of past emails. It quickly identified which employees had the authority to send money, who their managers were, and what their standard communication style looked like. The system then drafted convincing emails impersonating trusted contacts, asking targets to redirect payments to accounts controlled by the hackers. Microsoft recently led an operation to shut down this platform, seizing its websites and working with authorities to make arrests, but the incident reveals how quickly AI can scale up these kinds of digital scams.

To understand why this is a change, think of a traditional email hack like a burglar breaking into a library. To find the secret document they need, they have to physically scan thousands of books. This takes a long time and is prone to error. The AI tool acts like an expert librarian who can scan the entire collection in seconds. It looks for patterns—like invoices, bank authorizations, or specific phrases people use when discussing funds—and summarizes the most valuable information. Because the AI is trained to recognize these social and professional connections, it can generate a realistic lure that looks exactly like a message you would expect to receive from your boss. By the time an employee realizes something is wrong, the AI has already provided the criminal with a map of the company's relationships and the best way to exploit them.

This type of crime moves much faster than the old, manual methods. When attackers have tools that can summarize days of research into minutes of output, they can cast a wider net across more organizations. It serves as a stark reminder that even if an email looks legitimate, the contents might be generated by a machine designed to mimic a trusted colleague. The best defense remains old-fashioned: if you receive an unexpected request to change payment information or move funds, do not rely on the digital message. Reach out through a separate, trusted channel—like a phone call or an in-person conversation—to verify the request before you act. In an era where AI can fake the tone and context of a professional relationship, verifying the person behind the screen is more important than ever.