EvilTokens: AI-Driven Phishing Service Dismantled by Microsoft and Coinbase

A sophisticated AI-powered phishing service called EvilTokens has been dismantled by Microsoft and Coinbase after reaching over 10,000 organizations across multiple industries.

The operation used a subscription-based model sold through Telegram, where customers paid $1,500 to initiate the service and $500 per month for tools that combined account compromise, mailbox access, reconnaissance, and AI-assisted fraud preparation.

EvilTokens relied on Microsoft's device-code authentication, which attackers initiated themselves and sent to targets through phishing emails disguised as invoices or shared files. This gave the attackers an authenticated foothold inside the mailbox, allowing them to automate work that traditionally required hours of manual reconnaissance.

The AI tools used by EvilTokens could translate and summarize messages, identify reporting lines and trusted contacts, surface pending invoices and wire-transfer conversations, and determine which employees had authority over payments. Investigators also found evidence that parts of EvilTokens were built with AI-assisted coding tools, lowering the technical burden on both sides of the operation.

Coinbase's Global Intelligence team traced $1.1 million in revenue from four Tron addresses between October 2025 and June 2026, identifying over 1,000 deposits from more than 700 distinct addresses. The exchange combined transaction data with merchant records, device information, and open-source intelligence to attribute the platform to its alleged operators before referring the matter to London's Metropolitan Police.