AI fraud starts inside the inbox
Microsoft reports disrupting EvilTokens, a service that combined compromised email access with AI analysis of organizational relationships and payment conversations. Its account links the service to more than 12,000 inboxes across over 10,000 organizations, including higher education. The reported capability extended beyond drafting convincing messages: it helped identify trusted contacts and potential fraud opportunities inside a mailbox. Microsoft also warns that password resets alone may leave associated sessions and tokens usable. The September 22 report describes a specific operation and response; it does not establish a K-12 incident rate or show that a particular district was affected.
Why it matters for leaders
Editorial recommendation: Rehearse a fictional supplier-change request with identity and business-office teams. Verify session revocation, evidence preservation and a separate payment-confirmation channel. Cost: rehearsal time. Service: plan account recovery and office coverage. Risk: familiar writing proves little. Adoption: include finance and school-office staff in the exercise.
Cost, service, risk & adoption
Primary account from Microsoft's Digital Crimes Unit. Incident scale and disruption results are attributed to the investigating company.
What the evidence cannot tell us
Vendor investigation, not an independent prevalence study. Its broader victim population cannot be treated as evidence of local compromise.
Read the original sources
Summary and leadership analysis from the Week ending 2026-09-25 brief. The edition’s selection notes explain source access and evidence limitations.