Evil Tokens and the AI Money Mover Hunt | 2 Minute Drill with Drex DeFord

This transcription is provided by artificial intelligence. We believe in technology but understand that even the smartest robots can sometimes get speech recognition wrong.

Evil Tokens and the AI Money Mover Hunt | 2 Minute Drill with Drex DeFord

[00:00:00] Drex: Hey everyone, I'm Drex, and this is the Two Minute Drill, thanks to Fortified Health Security for sponsoring today's show. It's great to see everyone today. Here's some stuff you might wanna know about. You've seen this thing happen. You're signing into something like a smart TV or a printer or a team screen, maybe in a conference room, and the machine gives you a short code and tells you to go type that into a Microsoft page on your phone. And you do it and it works, and you go onto your meeting, and you don't give it a second thought. That little handoff is called a device code sign-in. It's super convenient, and it, for about six months this year, it was the front door for one of the busiest criminal businesses on the internet.

[00:00:42] Drex: Steve Masada is a lawyer. He runs Microsoft's Digital Crimes Unit, which is the team that sues criminals and then rolls in an offensive security team to take out the bad guy's infrastructure. All of this is done with a court order, and they've done it 39 times before. Number 40 was a service called Evil Tokens. These were cyber thugs who were leveraging that device sign-in code process to break into corporate email boxes. Evil Tokens launched in February on Telegram, and it ran like a software company. $1,500 to sign up, $500 a month after that. You got customer support, there was a help desk, there were management dashboards, 44 different kinds of phishing email pick from.

[00:01:26] Drex: Evil Tokens came with a catalog of ways they could help you break into an organization, especially if your focus was access to email boxes. Evil Tokens also came with an AI bot, and once you had broken into a company's email boxes, you could just point this little AI bot at any number of inboxes, and it would read all the email for you, and it had preset prompts, like find the wire transfer conversations, or find all the emails with vendor invoices, or figure out who the money movers are in this organization, or even things like figure out who those money movers trust, and in turn, tell me who I should pretend to be as I run this scam.

[00:02:11] Drex: Masada put it this way, AI was not simply helping attackers write more convincing messages, it was helping them decide who to target, and who to impersonate, and how to most effectively take advantage of the victim's relationships. Now a year ago, we were worried because AI was just writing really good phishing emails, and now that seems sort of quaint. Evil Tokens AI read the victim's emails, and then it worked out how to turn the victim into money. Work that used to take a crook several days now took hours or minutes. How many inboxes were involved in this specific cybercrime as a service?

[00:02:51] Drex: More than 12,000 across more than 10,000 organizations, mostly based in the US and Canada, the UK, Australia, India, and France. And investigators say that a big chunk of Evil Tokens infrastructure had been vibe coded. That means the criminals used AI to build the criminal AI. Microsoft tipped off London's Metropolitan Police in August. On September 11th, officers arrested two men aged 32 and 38 on suspicion of fraud and money laundering. They're out on bail while the investigation goes on. On September 22nd, a US federal court let Microsoft seize 50 websites in more than 150 domains.

[00:03:36] Drex: And the co-plaintiff on that lawsuit, Health ISAC. Healthcare was on the target list. And that really shouldn't surprise anybody. The health system pays vendors all day long, supplies and staffing agencies and construction and physician groups. And every one of those payments probably lives in somebody's inbox. And Evil Tokens AI was built specifically to find those payments and that transfer process. And that means the fake emails asking to change a vendor's bank account, that's gonna come from the right person about the right invoice in the right tone at the right time.

[00:04:12] Drex: Because a machine read the whole email thread first. So as a result, your defenses have to hold up when the email is practically perfect in every way. That means you need to take a whole new set of rules and put them in place, including things like always calling back on a known number before making any bank changes. Not the phone number in the email asking you to change their routing ID and account. Because that's kind of obvious, right? But use a phone number that you actually know to be legit. And get two humans involved on any large wire transfers. Double check each other, that just makes sense.

[00:04:52] Drex: Here's today's questions. Who are the money movers in your organization? And would an attacker be able to figure that out faster than your security team could figure out that this scam was in motion? And if a perfect email asked your AP team to change a vendor's bank account tomorrow, what stops it? That's it for today's two minute drill. Thanks again to Fortified Health Security for sponsoring today's podcast. Drop me a note, let me know what you're working on. I'm always happy to hear it. I'm Drex at 229project.com. Thanks for being here. Stay a little paranoid and I will see you around campus.