Microsoft, Coinbase, and law enforcement dismantle EvilTokens cybercrime network

A joint operation between Microsoft, Coinbase, and law enforcement agencies has taken down EvilTokens, an AI-powered phishing-as-a-service platform that compromised over 12,000 email inboxes across more than 10,000 organizations in 79 countries. Two alleged operators were arrested in London on September 11, 2026. Coinbase’s contribution was tracing approximately $1.1M in illicit revenue across four Tron addresses and more than 700 distinct deposit addresses linked to the operation. What EvilTokens actually did EvilTokens launched in February 2026 and operated as a subscription service for cybercriminals. The platform charged a $1,500 setup fee and $500 per month. The platform’s specialty was device-code attacks, a technique that tricks users into authenticating on a legitimate Microsoft login page while secretly handing their session tokens to attackers. This method effectively bypasses multi-factor authentication. EvilTokens didn’t stop at credential theft. The platform featured an AI chatbot specifically designed for inbox analysis and fraud planning. Once inside a compromised account, operators could use the chatbot to scan emails for financial information, identify high-value t...