AI-Powered Email Attacks Are Changing Cybercrime- What Florida Businesses Need to Know

Cybercriminals are getting better tools, and one of the latest cases shows just how quickly artificial intelligence is changing the way businesses are attacked.

On September 22, 2026, Microsoft announced that it had disrupted an AI-powered cybercrime service known as EvilTokens. Unlike a traditional phishing kit that simply tries to steal a username and password, EvilTokens was designed to help criminals compromise Microsoft 365 accounts, analyze stolen email messages, identify people who control money, and determine which employees or vendors would make the most convincing targets for fraud.

For Florida business owners, this story deserves attention because it demonstrates how quickly a simple compromised email account can turn into a much larger financial and cybersecurity incident.

More Than 12,000 Email Accounts Were Compromised

According to Microsoft, EvilTokens emerged in February 2026 and was connected to more than 12,000 compromised email inboxes at more than 10,000 organizations worldwide within a matter of months. Microsoft observed a particularly high concentration of victims in the United States.

Affected industries included construction, real estate, healthcare, financial services, education, and wholesale distribution. These are exactly the kinds of organizations found throughout Florida's local business communities.

Microsoft, Health-ISAC and other partners ultimately disrupted infrastructure supporting the operation. Microsoft reported seizing 50 websites and disabling more than 150 additional domains associated with the platform.

But shutting down one criminal service does not eliminate the underlying threat. The technology and attack techniques demonstrated by EvilTokens can be copied and adapted by other criminal groups.

The Attack Did Not Necessarily Require Stealing Your Password

One of the most concerning parts of the EvilTokens operation was its use of a technique known as device-code phishing.

Microsoft 365 sometimes uses device codes when a device or application needs to authenticate to an account. Criminals learned how to manipulate this legitimate authentication process.

A victim could receive an email containing what appeared to be a legitimate request involving an invoice, document, request for proposal, shared file or other business communication.

The victim would then be instructed to enter an authentication code on Microsoft's legitimate sign-in page.

The website itself could actually belong to Microsoft.

That makes the attack particularly deceptive.

By entering the attacker's code, the employee could unknowingly authorize the criminal's session.

The attacker could then obtain an authentication token that allowed access to the employee's account without necessarily knowing the employee's password.

This is an important lesson for business owners because it demonstrates why simply telling employees to "look for fake websites" is no longer enough.

Artificial Intelligence Made the Stolen Email Much More Valuable

Once criminals gained access to an email account, EvilTokens could use artificial intelligence to analyze the contents of the mailbox.

Traditionally, a criminal who compromised an employee's email might have to spend hours reading conversations to understand how the company operates.

Artificial intelligence can dramatically accelerate that process.

Microsoft says EvilTokens could analyze compromised inboxes to identify financial conversations, trusted relationships, organizational roles, executives, vendors and employees responsible for making or approving payments.

The system could look for conversations involving wire transfers, invoices and payment approvals.

That information could then help criminals determine whom to impersonate.

Imagine that a criminal compromises an employee's Microsoft 365 account at a Florida construction company.

The attacker may discover months of conversations between the company and a subcontractor.

Artificial intelligence could quickly determine who normally sends invoices, who approves them, what language they typically use and when payments are normally made.

The attacker could then send a convincing message requesting that the next payment be sent to a different bank account.

To the employee receiving that request, everything could appear normal.

The message could even come from a legitimate company email account.

This Is Business Email Compromise on Steroids

Business Email Compromise, commonly called BEC, has been one of the most financially damaging types of cybercrime for years.

The basic concept is simple. Criminals impersonate someone the victim trusts and convince the victim to transfer money or disclose sensitive information.

AI-powered systems can make those attacks considerably more convincing.

Instead of sending thousands of poorly written emails and hoping someone responds, criminals can potentially analyze an organization's actual communications and create messages specifically designed for individual employees.

A criminal may know which vendor you are expecting an invoice from.

They may know the dollar amount.

They may know which employee normally approves the payment.

They may even know how that employee usually writes an email.

That dramatically increases the importance of having procedures that do not rely solely on trusting the contents of an email.

A Password Change May Not Be Enough

Another important lesson from the EvilTokens incident involves authentication tokens.

When attackers steal an authentication token, they may be able to remain logged into an account even after the user changes the account password. Microsoft noted that access could potentially persist unless associated sessions and tokens were also revoked.

This is why responding to a Microsoft 365 compromise should involve more than simply resetting the employee's password.

An incident response process may also need to include reviewing active sessions, revoking authentication tokens, examining registered devices, reviewing mailbox forwarding rules and checking for suspicious login activity.

Attackers frequently create email rules designed to hide messages from the legitimate account owner. For example, they may automatically move replies from a vendor or bank into a hidden folder so the employee never sees them.

Microsoft reported that malicious inbox rules were used during activity associated with EvilTokens.

Multifactor Authentication Is Still Important, But It Is Not Invincible

Some businesses believe that enabling multifactor authentication means an account cannot be compromised.

MFA remains one of the most important security protections a business can implement, but attackers are increasingly developing techniques designed to bypass or manipulate authentication workflows.

Device-code phishing is one example.

The employee may actually complete an authentication process themselves, unknowingly authorizing the attacker.

Businesses should therefore combine MFA with additional identity protections, monitoring and employee training.

Where appropriate, organizations using Microsoft 365 should also consider Conditional Access policies, restrictions on device-code authentication and alerts for unusual login activity.

Microsoft specifically recommends blocking device-code authentication where it is not required.

Organizations that legitimately require it for certain devices can create narrow exceptions instead of allowing the authentication method broadly.

Florida Businesses Should Pay Particular Attention to Payment Fraud

Florida has a large number of small and midsize businesses in industries such as construction, professional services, healthcare, real estate, hospitality and property management.

Many of these organizations regularly exchange invoices and payment instructions through email.

That makes payment verification procedures extremely important.

Any unexpected request to change banking information should be verified independently.

For example, if a vendor sends an email stating that its bank account has changed, an employee should call a previously known telephone number for that vendor and verify the change verbally.

Do not simply call a number contained in the suspicious email.

Likewise, unusually large wire transfers, changes in payment destinations and urgent executive requests should receive additional verification.

Microsoft specifically recommends independently verifying requests involving changes to payment information or unusual financial transactions through a second trusted communication channel.

Employee Cybersecurity Training Is Becoming More Important

Modern phishing attacks may no longer contain obvious spelling mistakes, awkward sentences or poorly designed websites.

Artificial intelligence can generate professional-looking messages almost instantly.

That means cybersecurity awareness training needs to evolve.

Employees should be taught to recognize unusual requests rather than simply looking for poorly written emails.

Warning signs could include unexpected authentication requests, unfamiliar QR codes, unusual

Microsoft login prompts, sudden changes to payment instructions, requests for gift cards or wire transfers, unexpected shared documents and pressure to bypass normal company procedures.

Employees should also know exactly who to contact when something does not look right.

A five-minute phone call to the IT department can prevent a mistake that might otherwise cost a business tens of thousands of dollars.

Businesses Need Multiple Layers of Protection

No single cybersecurity product can stop every attack.

A strong cybersecurity strategy uses multiple layers of protection so that if one layer fails, another can still prevent or detect the attack.

For Microsoft 365 environments, businesses should consider strong multifactor authentication,

Conditional Access policies, advanced email filtering, Microsoft 365 security monitoring and alerting, endpoint detection and response software, automated patch management, DNS and web filtering, password management and regular employee security training.

Administrators should also monitor suspicious mailbox rules, unusual device registrations, abnormal login locations and unexpected changes to user accounts.

Microsoft recommends protections such as stronger anti-phishing settings, Zero-hour Auto Purge through Microsoft Defender for Office 365, browser protections such as Microsoft Defender

SmartScreen and alerting for suspicious inbox-rule creation.

Assume a Compromised Inbox Can Be Analyzed Immediately

Perhaps the most important lesson from the EvilTokens story is how quickly the value of a compromised email account has changed.

In the past, an attacker might have needed hours or days to manually analyze a victim's mailbox.

Artificial intelligence can potentially perform much of that analysis almost immediately.

Once an attacker enters an account, businesses should assume the criminal may rapidly identify customers, employees, vendors, payment processes and sensitive conversations.

That makes early detection extremely important.

Businesses should have security systems capable of identifying suspicious activity quickly rather than discovering an account compromise weeks later.

Cybersecurity Is Becoming a Business Requirement

Cybersecurity is no longer something only large corporations need to worry about.

Services such as EvilTokens demonstrate how cybercriminals are building commercial platforms that make sophisticated attacks available to criminals who may have relatively little technical knowledge.

Microsoft said EvilTokens was sold as a subscription service, reportedly charging a $1,500 initiation fee followed by a $500 recurring subscription.

In other words, cybercrime continues to become easier to purchase, automate and scale.

For Florida business owners, the response should be to make cybersecurity part of normal business operations.

Protect employee identities. Secure Microsoft 365. Monitor suspicious activity. Back up critical information. Train employees. Require secondary verification before important financial transactions.

Most importantly, create a plan before an incident happens.

The technology used by cybercriminals will continue to evolve. Businesses that rely exclusively on antivirus software and employee passwords are increasingly likely to find themselves several steps behind the attackers.

The EvilTokens takedown is good news, but the techniques it demonstrated are a warning about where cybercrime is heading next.