Microsoft and Coinbase dismantle EvilTokens AI phishing network

Microsoft, Coinbase, and international law enforcement have dismantled EvilTokens, an AI-powered phishing-as-a-service network that compromised over 12,000 email inboxes across 10,000 organizations. The platform exploited Microsoft's device-code authentication to bypass multi-factor authentication, using AI tools to automate financial fraud reconnaissance. Coinbase traced $1.1 million in crypto revenue on the Tron blockchain, leading to the arrest of two suspects by London police on September 11, 2026, and the court-authorized seizure of 50 websites.

EvilTokens phishing platform takedown

• ▪Microsoft, Coinbase, and law enforcement partners dismantled EvilTokens, an AI-powered phishing-as-a-service network that compromised over 12,000 email inboxes across more than 10,000 organizations
• ▪The EvilTokens phishing campaign targeted organizations across 79 countries, with concentrations in the United States, Canada, the United Kingdom, Australia, India, and France
• ▪The EvilTokens platform operated as a subscription service sold through Telegram, charging users an initiation fee of $1,500 and a recurring monthly subscription fee of $500

AI-powered fraud automation tools

• ▪EvilTokens featured an AI-powered analyst tool that automated inbox reconnaissance by scanning emails, translating messages, identifying reporting lines, and recommending which employees to impersonate for financial fraud
• ▪Investigators found evidence that parts of the EvilTokens platform itself were built using AI-assisted coding tools, lowering the technical barrier for its operators and customers
• ▪Prior to the takedown of EvilTokens, its operator had signaled plans to expand the phishing toolkit to target Okta and Gmail accounts

Device-code authentication exploitation

• ▪EvilTokens exploited Microsoft's device-code authentication flow, a legitimate sign-in mechanism designed for hardware like smart TVs that cannot easily support standard browser logins
• ▪By tricking victims into entering attacker-initiated codes on legitimate Microsoft websites, EvilTokens bypassed multi-factor authentication and generated persistent session authorization that survived password resets

Cryptocurrency payment tracing

• ▪Coinbase's Global Intelligence team traced approximately $1.1 million in EvilTokens platform revenue across four Tron blockchain addresses between October 2025 and June 2026
• ▪The $1.1 million in traced cryptocurrency revenue from EvilTokens originated from more than 1,000 deposits across over 700 distinct deposit addresses

Domain seizures legal action

• ▪Under a United States District Court order, Microsoft and its partners seized 50 websites and disabled over 150 domains associated with the EvilTokens infrastructure
• ▪Microsoft and Coinbase's civil and technical action against EvilTokens evolved into a broader coalition of technology firms, including Cloudflare and OpenAI

Debatable claims

• ▪Microsoft should disable device-code authentication by default
• ▪AI developers should restrict coding assistants from generating potentially malicious code
• ▪Messaging platforms should be legally required to proactively police cybercrime marketplaces