AIR-2025-0024 · Microsoft reported blocking ~1.6 million bot signup attempts per hour and thwarting $4 billion in AI-assisted fraud over twelve months

Microsoft reported blocking ~1.6 million bot signup attempts per hour and thwarting $4 billion in AI-assisted fraud over twelve months

AIR-2025-0024 AIR record · 2025-04-microsoft-cyber-signals-ai-fraud-bot-signups

A real party was affected. This incident caused actual consequences, not a demonstrated capability.

From the supporting source

Between April 2024 and April 2025, Microsoft: - Thwarted $4 billion in fraud attempts. - Rejected 49,000 fraudulent partnership enrollments. - Blocked about 1.6 million bot signcnbctv18.com

The record

Disclosed

2025-04-16

Occurred

2024-04

Vendor

Microsoft

Product

Microsoft Azure, Edge and account infrastructure

Risk domain

Agent behaviour › Unsafe actuation

System type

Generative model

Who acted

Agent acted — bots autonomously created accounts at ~1.6M attempts/hour

Attack surface

Autonomous operations

Autonomy level

Fully autonomous

Initial vector

Automated account abuse

Impact type

Financial loss, Ecosystem abuse

Confidence

High

Submitted by

EAI Internal

Crosswalk

OWASP Agentic Top 10 (2026): ASI01 – Agent Goal Hijack
MITRE ATLAS: AML.T0048 – External Harms
NIST AI RMF: MEASURE 2.6; MANAGE 1.3
EU AI Act: Annex III §1(c)
ISO/IEC: TR 24028; 24029-1; 23894
AIUC-1: C. Safety
Scope: agent misuse
Mitigation: Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
Taxonomy: Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery

Blast radius

platform-wide; $4bn in fraud attempts, 49,000 fraudulent partnership enrolments and ~500 malicious domains taken down between April 2024 and April 2025

Capability abused

automated_account_creationcontent_generationconversational_impersonation

Defense & remediation

Recorded defense

Microsoft anti-fraud and bot-detection systems

Guardrail kinds

Unknown

Guardrail outcome

Silent

Fix shipped

anti-scam features in Edge and Quick Assist; ongoing enforcement

Taxonomy & references

OWASP ASI03 Identity and Privilege Abusescaled_automationbot_signupsfraud_economyvendor_telemetrytracked_actor_growth

Curator notes

Included for the denominator rather than any single event: it is the only record giving a platform-scale rate for automated agent abuse. Microsoft's tracked-actor count went from 300 to 1,500 in a year. defense_bypassed is false — these are blocks, not breaches — but impact_realized stays true given the confirmed fraud attempts and domain takedowns. Primary source is Microsoft's own Cyber Signals issue 9. AI Incident Database incident 1037.

Cite as

Enkrypt AI. "Microsoft reported blocking ~1.6 million bot signup attempts per hour and thwarting $4 billion in AI-assisted fraud over twelve months". AIR, AIR-2025-0024. https://agentincident.vercel.app/i/AIR-2025-0024/ (accessed 2026-10-19).