UK Police Arrest Two After Microsoft Removes ‘EvilTokens’ AI Crime Bot

British officials have placed two suspects in custody after Microsoft removed the “EvilTokens” chatbot from its platform. The service, which ran on Telegram, advertised itself to cyber‑offenders for a $1,500 sign‑up fee and a $500 monthly subscription, promising AI‑powered tools that could break into accounts, scan compromised mailboxes and suggest the most lucrative ways to exploit stolen data.

Microsoft moved to shut the bot after receiving several abuse reports that tied it to a spike in credential‑theft incidents throughout Europe. In its takedown request the company cited breaches of its terms of service and the broader danger the tool posed to users. Once the service was disabled, law‑enforcement agencies launched a rapid investigation that culminated in the arrests.

The detained pair are accused of operating the chatbot’s backend and handling payments from its subscribers. Their identities remain undisclosed, but officials said the suspects employed anonymising services and cryptocurrency wallets to mask transactions, a tactic common among operators of underground cyber‑crime markets.

“EvilTokens” represented a fresh incarnation of criminal‑as‑a‑service, exploiting sophisticated language models to automate many tasks that formerly required manual skill. Police say the AI could sift through massive volumes of stolen emails, pinpoint high‑value credentials and even generate phishing messages tailored to individual targets, dramatically lowering the technical hurdle for less‑experienced attackers.

Security researchers note that the incident underscores the dual‑use dilemma of generative AI. While the technology can boost productivity, it can also be weaponised to streamline illicit activity. “We are seeing a rapid commoditisation of hacking tools powered by AI,” said a researcher at a leading security firm. “Platforms that host communication channels, like Telegram, are increasingly becoming vectors for these services, and the challenge for providers is to detect and act on abuse before it scales.”

UK lawmakers have been calling for stricter regulation of AI‑enabled services, particularly those that facilitate crime. The recent arrests could add momentum to pending bills that would oblige companies to monitor and report suspicious AI applications, though critics warn that overly broad rules might choke legitimate innovation.

Investigators are still probing the full scope of the operation, including whether the chatbot served customers outside the United Kingdom. The case also raises questions about the duty of platform providers to police AI‑driven content and the resources required to keep pace with fast‑evolving threats. As legal proceedings continue, authorities say they remain determined to dismantle similar services that exploit emerging technologies for criminal gain.