Coinbase and Microsoft dismantle AI-powered phishing network EvilTokens
$1.1M crypto trail traced as 175 domains seized in global cybercrime operation
1Phishing-as-a-service platform
EvilTokens operated as a Telegram-distributed cybercrime service, offering AI-powered tools for email account compromise and payment redirection. The service specialized in researching infected mailboxes to identify high-value targets and trusted relationships. Criminal customers could launch sophisticated phishing campaigns without technical expertise, paying for the service in cryptocurrency through TRON blockchain addresses.
2Coinbase's forensic role
Coinbase's Global Intelligence team traced $1.1 million in transactions between October 2025 and June 2026 linked to EvilTokens operations. They identified over 1,000 deposits from more than 700 distinct crypto addresses flowing through Coinbase's systems. The exchange's blockchain analysis capabilities proved crucial in mapping the financial infrastructure supporting the phishing operation while confirming no platform infiltration occurred.
3Microsoft's domain takedown
Microsoft led the technical disruption, seizing 50 websites and disabling 175+ domains in EvilTokens' infrastructure. The operation exploited a vulnerability in Microsoft's device-code authentication, where victims were redirected to fake login pages. Attackers then used captured codes on legitimate Microsoft pages, bypassing password theft. Microsoft reported over 12,000 compromised inboxes across 10,000+ organizations during the campaign.
4Multi-industry impact
The phishing operation affected diverse sectors including financial services, healthcare, construction, real estate and higher education. EvilTokens' AI tools analyzed compromised accounts to identify payment conversations and ideal impersonation targets. The service's effectiveness came from combining automated analysis with human-operated elements, creating a hybrid attack model difficult to detect with traditional security tools.
5Law enforcement collaboration
UK police arrested two suspects on September 11, 2026 as part of the international operation. Legal action was pursued in Virginia's Eastern District Court with support from Health-ISAC. The case demonstrated how cryptocurrency transactions, despite their pseudonymity, can provide investigators with persistent payment trails when combined with exchange compliance data and traditional investigative techniques.
6Technical partners' involvement
Cloudflare, OpenAI, Railway, SpyCloud, TRM Labs and The Shadowserver Foundation contributed specialized capabilities to the takedown. Each organization addressed different components of EvilTokens' infrastructure - from domain hosting to AI model abuse prevention. This public-private partnership model has become increasingly vital against sophisticated cybercrime services that leverage multiple technologies.
7Crypto's investigative value
The operation highlighted blockchain's dual nature in cybercrime - serving as both payment mechanism and forensic tool. While EvilTokens used crypto for monetization, the immutable transaction history enabled investigators to follow money flows across 700+ addresses. This case establishes precedent for combining on-chain analytics with conventional cybersecurity approaches in financial crime investigations.
8New fraud prevention paradigm
The takedown demonstrates how AI-powered threats require equally sophisticated defense collaborations. By combining Microsoft's authentication expertise, Coinbase's financial intelligence, and law enforcement's jurisdictional reach, the alliance created a multidimensional response. This sets a template for addressing future cybercrime-as-a-service models that inevitably will emerge in the evolving threat landscape.