#

Key takeaways

• Microsoft’s Digital Crimes Unit published the post on September 22, 2026.

• Microsoft says it obtained court authorization to disrupt EvilTokens infrastructure.

• Public reporting based on Microsoft’s statement says the service used AI tools.

• Microsoft estimated more than 12,000 email inboxes across 10,000 organizations were compromised.

• Those figures are Microsoft’s estimates, not independently adjudicated findings.

Microsoft’s latest cybercrime-disruption action

Microsoft’s Digital Crimes Unit published a post on September 22, 2026 titled *“Disrupting EvilTokens: The AI Chatbot Built for Cybercrime.”

• The source record identifies it as a company-news item in Microsoft’s AI archive. Microsoft says it obtained authorization from the U.S. District Court for the Eastern District of Virginia to disrupt infrastructure tied to the service.

The post centers on a service called EvilTokens. Microsoft describes the action as a disruption of that infrastructure. The source material does not provide a full technical breakdown of the service, so any deeper description would be an assumption.

What Microsoft said about the service

Public reporting based on Microsoft’s statement says the platform used AI tools. The source also says Microsoft estimated that more than 12,000 email inboxes across 10,000 organizations had been compromised. Those numbers should be read as Microsoft’s estimates.

That distinction matters. The source material does not say those figures were independently verified in court or by another adjudicator. It also does not say the estimates represent a final legal finding. Readers should separate reported allegations and company estimates from confirmed judicial outcomes.

Why the wording matters

The title frames EvilTokens as an AI chatbot built for cybercrime. The source material supports that framing only at the level of Microsoft’s own reporting and the public reporting that followed it. It does not supply independent technical validation in the text provided here.

The article also sits in a specific context. The source says this is a current cybercrime-disruption event. It is distinct from Microsoft’s separate AI-diffusion report and from Anthropic’s September misuse report. That means the story should be read on its own terms, not merged with other AI safety or misuse disclosures.

Reported facts versus analysis

The reported facts are limited and clear. Microsoft published the post on September 22, 2026. Microsoft says it obtained court authorization. Microsoft also says it disrupted infrastructure tied to EvilTokens.

The analysis is narrower. The event shows how AI tools can be discussed in the context of cybercrime operations. It also shows that companies may use legal process and technical disruption together. Beyond that, the source material does not support broader claims about the scale, geography, or downstream effects of the operation.

Operational and governance considerations

This source points to a few general considerations. First, attribution matters. A company statement is not the same as an independent finding. Second, legal authorization matters when infrastructure disruption is involved. Third, estimates should be labeled as estimates until confirmed elsewhere.

The source material does not provide enough detail to assess the full operational impact of the disruption. It also does not describe any remediation steps, victim support process, or follow-up enforcement action. Those details would require additional sourcing.

Morocco relevance

The source reports no Morocco-specific fact. It does not mention Moroccan organizations, authorities, customers, or local impact. A conditional global lesson is that readers should verify whether any cybercrime-disruption report affects their own systems before drawing conclusions.

Source attribution

This summary is based on Microsoft’s Digital Crimes Unit post published on September 22, 2026, titled *“Disrupting EvilTokens: The AI Chatbot Built for Cybercrime,”

• and the accompanying Microsoft AI archive record. It also reflects public reporting that cites Microsoft’s statement. The source material provided here should be treated as the basis for all factual claims in this article.