> daily_signal(2026_09_24)
An AI crime service went up for rent, the family behind Oracle's surveillance closed in on CNN and CBS, the US and China agreed to a hotline they haven't built, and one AI went looking for a doctor.
PickBits Daily Signal · Thursday, September 24, 2026
// tl;dr
- Microsoft's Digital Crimes Unit won a court order to seize EvilTokens, the first end-to-end AI cybercrime service it has taken down. The Telegram-sold service ($1,500 signup plus $500 a month) used an AI analyst to read more than 12,000 hacked Microsoft 365 inboxes across 10,000+ organizations and pick which employee controlled payments; two men were arrested in the UK.
- Warner Bros. Discovery shareholders approved the roughly $111 billion Paramount Skydance merger, and a September 21 state-attorneys-general settlement cleared its last hurdle. It hands the Ellison family, whose Oracle runs an "ID Graph" it says tracks more than 5 billion people and holds a roughly $7 billion Pentagon contract, control of CNN, CBS, HBO, Paramount+ and Paramount Pictures.
- The US and China agreed to build a standing AI communication and notification "hotline" after eight-hour talks in New York, days before the Trump-Xi summit. Wired reports it will not be ready for a while, and analysts call a real agreement to slow AI development extremely unlikely.
- OvyHealth says it is using AI to triage fertility and OB-GYN patients and route them to an available clinic across about 400 partners in six countries. It books people into care rather than diagnosing them, and the figures are the company's own, from a single Tech in Asia report, early and not yet independently verified.
The one that stuck with me this week was EvilTokens. The warnings about AI and crime used to be hypothetical, but we've watched them turn concrete these past few weeks, and now Microsoft has found the actual product: a crime service you rent by the month, with an AI that reads your hacked inbox and picks who to rob. What I keep coming back to is that Microsoft didn't patch it, it sued it, and for once the people behind an AI harm got named in a court filing.
The other three I'm less settled on. The Ellison family closing in on CNN and CBS cleared in a legal settlement instead of a public hearing, so most people will never get a say. The US-China hotline is an announcement with nothing behind it yet. And the story I actually liked, an AI helping people find a doctor, comes from one company telling us its own numbers, which we can't check. Two of these we've been on for months, and both got sharper this week.
Microsoft had to sue to shut down a crime service that anyone could rent for five hundred dollars a month.
1. Microsoft seized the first end-to-end AI cybercrime service.
EvilTokens read 12,000 hacked inboxes, sold on Telegram for $1,500 plus $500 a month, and used an AI analyst to pick which employee controlled the money.
For years the worry about AI and crime was a hypothetical, that someday a model would help criminals. EvilTokens is that someday, already built and priced. On September 22, 2026, Microsoft's Digital Crimes Unit won an order from the US District Court for the Eastern District of Virginia to seize 50 websites and disable more than 150 domains behind it, Microsoft's 40th court-authorized takedown since 2008 and, it says, its first against an end-to-end AI-enabled cybercrime service. The thing wasn't malware. It was a product: launched in February 2026, sold on a Telegram storefront for a $1,500 signup plus $500 a month, using AI at every step of the attack.
What it sold was an AI "analyst" that read a hacked inbox, mapped who inside a company trusted whom, and pinpointed the one employee who actually controls payments, then designed the impersonation to drain the account. It was tied to more than 12,000 compromised Microsoft 365 accounts across over 10,000 organizations, most of them in the US; two men, aged 32 and 38, were arrested in the UK, and Microsoft ran the takedown with Health-ISAC, Cloudflare and Coinbase. Eight days ago we covered the million-email invoice-scam wave Microsoft caught hitting US companies. This is the factory behind that kind of attack. The crime didn't get more sophisticated here. It got easier to buy, which is worse.
Why this matters: The scam that quietly drains a company's bank account no longer takes a skilled criminal to run, it takes a credit card and a Telegram handle. Business email compromise is the scam every finance team already fears, and EvilTokens turned the hardest part, finding the right person to impersonate, into a feature you rent.
Action this week: Ask your security vendor one question in writing: when a fraudulent request comes from a real, compromised account inside your own supply chain, what actually stops it, because your spam filter won't. When I have pushed vendors on this, the honest ones admit their controls assume the sender is either trusted or a stranger, and this attack is neither. Get the answer before your finance team finds out the hard way.
therecord.media: Two arrested in UK after Microsoft takedown of EvilTokens AI cybercrime service (September 22, 2026)
blogs.microsoft.com: Disrupting EvilTokens, the AI chatbot built for cybercrime (September 22, 2026)
cyberscoop.com: Microsoft takes down EvilTokens end-to-end AI cybercrime service (September 2026)
thehackernews.com: Microsoft takes down EvilTokens AI-enabled cybercrime platform (September 2026)
2. A $111 billion merger just handed the Ellison family CNN, CBS and HBO.
Warner Bros. Discovery shareholders approved the deal, and a state-attorneys-general settlement, not a public hearing, cleared its last hurdle.
We flagged the Oracle surveillance arc back when the Pentagon handed the company its roughly $7 billion contract. This week it grew a media wing. Warner Bros. Discovery shareholders approved the roughly $111 billion takeover by Paramount Skydance, with the Ellison family and RedBird Capital financing $43.6 billion of it at $31.00 a share in cash, and a state-attorneys-general antitrust settlement announced September 21 cleared the deal's last major hurdle.
The reason to care isn't the media drama. It's that one family ends up owning both the surveillance and the news. Larry Ellison's Oracle runs an "ID Graph" the company says tracks more than 5 billion people, holds that Pentagon contract, co-owns TikTok's US operations, and is a central partner in the $500 billion Stargate data-center build; his son David now runs Paramount. Together the family gains CNN, CBS, HBO, Paramount+ and Paramount Pictures. You can call this ordinary consolidation if you want, one more deal in a shrinking industry. I don't buy ordinary when the last sign-off happened in a settlement document instead of a hearing anyone could show up to, and the surveillance business under the same roof isn't part of anyone's review.
Why this matters: The company that says it can track five billion people is about to own the news you watch. When the same family helps run federal surveillance and owns CNN and CBS, that should bother you more than it seems to bother anyone in a position to stop it.
Action this week: Read the settlement your own state attorney general signed onto, because that office is the public official who answers for waving this through, and press them on what they actually got in return. The deal still isn't final; closing waits on a court ruling or times out by next June, so the window isn't shut yet. My own read is that the settlement was the quiet part, and it's worth making noise before that court sign-off closes the book.
theintercept.com: The Ellisons could make a killing in surveillance with the Paramount merger (September 23, 2026)
cnbc.com: Paramount reaches settlement with states over Warner Bros. Discovery merger (September 21, 2026)
washingtonpost.com: Paramount settles with states over Warner Bros. Discovery merger (September 21, 2026)
npr.org: What the Warner Bros. Discovery and Paramount Skydance merger means (2026)
3. The US and China agreed to an AI hotline, days before Trump and Xi meet.
The channel is aimed at national-security AI incidents, but Wired reports it will not be ready for a while, and a real slowdown looks unlikely.
This one is getting sold as cooperation, and it's a lot smaller than that. Ahead of the September 24 Trump-Xi summit, US and Chinese negotiators did something they had avoided for years: after an eight-hour meeting at JPMorgan's New York headquarters on September 20-21, Treasury Secretary Scott Bessent and Trade Representative Jamieson Greer, with Vice-Premier He Lifeng, agreed to build a regular US-China communication and notification mechanism on AI, a "hotline" aimed at national-security AI incidents.
The catch is in the fine print. Wired reports the hotline "won't be ready for a while," and analysts call an actual agreement to slow AI development "extremely unlikely." This lands on the arc we have tracked all summer, with China weighing tighter export controls, the US easing chip rules for allies, and both sides trading sanctions threats. A phone line between the two is genuinely new. It is also the cheapest possible cooperation, the kind you announce before a summit to have something to announce. What they are really fighting over isn't safety. It's which government gets to look like the responsible one.
Why this matters: The US-China summit just put your export-control exposure and AI-vendor risk on one table. If your stack depends on chips, models, or cloud tied to either country, the rules that govern it are what move next, not the handshake.
Action this week: Pull your AI and chip vendors' exposure to Chinese supply and to export-control changes, and get their contingency plan in writing before the rules shift again. Track the real lever too: export controls change through public rulemaking at Commerce, not at the summit. Honestly, the summit is the noise; the rulemaking is what actually moves, and that is where I would be looking.
scmp.com: US and China seek Xi-Trump summit deliverables in New York talks (September 23, 2026)
cnbc.com: US and China agree to AI dialogue on safety and chips ahead of Trump-Xi meeting (September 23, 2026)
wired.com: A US-China AI hotline won't be ready for a while (September 2026)
bloomberg.com: Bessent hails "very successful" China talks on AI threats and trade (September 21, 2026)
PickBits Daily Signal is free. If it lands in your inbox every day and it's worth something to you, the best way to support it is to forward it to someone who would read it. Subscribe today!
4. An AI is routing patients to fertility care where the OB-GYNs ran out.
OvyHealth says it matches people to an available clinic across about 400 partners in six countries, early, single-sourced, and about access, not diagnosis.
Picture someone in a rural county where the nearest OB-GYN is fifty miles away, trying to start fertility treatment against a wait measured in months. That person is who this is for. Tech in Asia's September 21 report describes a startup, OvyHealth, using AI to triage fertility and reproductive-health patients and match them, in near real time, to an available provider inside a network it says spans about 400 clinical partners across six countries.
The pitch is deliberately narrow, and that narrowness is the point. The AI doesn't diagnose or treat, it reads a patient's situation and routes them to a clinic that can actually see them, aiming at the delay rather than the diagnosis. This is the kind of health AI I actually like, the same reason we covered the lung-cancer and brain-bleed models this month: it helps someone get to a doctor instead of trying to be one. It comes with a real caveat, though. This is one company's story from a single outlet, the 400-partner, six-country figures are OvyHealth's own, and patient volumes and outcomes haven't been independently checked.
Why this matters: There's no OB-GYN for miles, and an AI is now trying to find you one. The everyday win is small and real: instead of a months-long wait or a two-hour drive, software points you to a clinic in the network that can see you sooner.
Action this week: Ask any service like this one plain question before you trust it: does it route you to licensed clinics that can actually see you soon, or just hand you a longer list. Then watch whether the 400-partner number holds up when someone outside the company counts it. I have a soft spot for tools that just help someone reach a doctor instead of trying to replace one, so I will follow this, carefully.
techinasia.com: AI triages fertility care to solve regional OB-GYN shortages (September 21, 2026)
» What to watch this week
- Whether another AI-crime-as-a-service platform surfaces before the next takedown. EvilTokens was the first end-to-end one Microsoft named, and the subscription model means it will not be the last; the tell is how fast a competitor fills the gap.
- Whether the court signs off, and on what terms. The shareholder vote and the state settlement are done, but closing still waits on a court ruling that can run to June 2027, and that is the last public checkpoint on the deal.
- Whether the US-China AI hotline gets any actual specifics. An announced channel with no text, no staff, and no timeline is a press release; watch for whether the summit turns it into something with a phone number.
- Independent verification of OvyHealth's numbers. A single company's 400-partner, six-country claim is a starting point, not a proven network, and the milestone is a second source counting the same thing.
Tomorrow's signal lands here.