EvilTokens AI-Phishing Platform Brought Down by Microsoft, Coinbase, Law Enforcement

A joint operation between Microsoft, Coinbase, and law enforcement agencies has taken down EvilTokens, an AI-powered phishing-as-a-service platform that compromised over 12,000 email inboxes across more than 10,000 organizations in 79 countries. The platform's operators were arrested in London on September 11, 2026.

EvilTokens launched in February 2026 and operated as a subscription service for cybercriminals, charging a $1,500 setup fee and $500 per month. It used device-code attacks to trick users into authenticating on a legitimate Microsoft login page while secretly handing their session tokens to attackers, effectively bypassing multi-factor authentication.

The platform also featured an AI chatbot designed for inbox analysis and fraud planning, allowing operators to scan emails for financial information, identify high-value targets within an organization, and plan follow-up attacks. Coinbase's blockchain analysis team provided the financial forensics, tracing approximately $1.1M in illicit revenue across four Tron addresses and more than 700 distinct deposit addresses linked to the operation.