Coinbase Followed $1.1M Crypto Trail to Dismantle AI Phishing Service EvilTokens

Microsoft and Coinbase dismantled EvilTokens, an AI-powered phishing operation

The service compromised more than 12,000 inboxes and reached 10,000 organizations within months, hitting financial services, real estate, healthcare, and construction sectors. UK police arrested two men on Sept. 11 on suspicion of involvement; both were later released on conditional bail.

Subscription model and attack method

EvilTokens sold access through Telegram for a $1,500 initiation fee plus $500 monthly. The platform exploited Microsoft’s device-code authentication flow, sending phishing emails that looked like invoices or shared files. Victims entering the code on Microsoft’s site effectively approved the attacker’s session.

AI tools and reconnaissance

The service used AI to summarize messages, map reporting lines, surface pending invoices, and identify “money movers.” Preset prompts recommended impersonation targets, cutting manual reconnaissance time. Parts of the platform were built with AI-assisted coding tools, lowering the technical barrier.

Coinbase traced $1.1 million revenue trail

Coinbase’s Global Intelligence team tracked roughly $1.1 million across four Tron addresses between October 2025 and June 2026, identifying 1,000 deposits from 700 distinct addresses. The exchange combined transaction data with merchant records and open-source intelligence before referring the case to London’s Metropolitan Police.

Downstream impact and future risks

Some Coinbase customers were manipulated into sending crypto to scam addresses, though accounts and credentials were not compromised. EvilTokens’ operator had signaled plans to expand to Gmail and Okta. Microsoft warns that removing infrastructure does not eliminate the method and recommends blocking unnecessary device-code authentication.

Source: CryptoSlate