Microsoft and Coinbase Dismantle AI Phishing Service EvilTokens

A sophisticated AI phishing service called EvilTokens was dismantled by Microsoft and Coinbase after reaching over 10,000 organizations across various industries in just a few months. The service relied on artificial intelligence to automate the process of compromising business email accounts.

EvilTokens used Microsoft's device-code authentication as its entry point, sending fake invoices or other routine business communications to victims who then entered the resulting code on Microsoft's legitimate website. This gave the attackers an authenticated foothold inside the mailbox.

The AI tools available in EvilTokens could translate and summarize messages, identify reporting lines and trusted contacts, surface pending invoices and wire-transfer conversations, and determine which employees had authority over payments.

Coinbase traced around $1.1 million in revenue from EvilTokens platform between October 2025 and June 2026, identifying more than 1,000 deposits from over 700 distinct addresses. This financial trail helped investigators attribute the operation to its alleged operators and contributed to Microsoft's civil action against the service.

Microsoft recommends that organizations block device-code authentication where it is unnecessary and tightly restrict it where operationally required. The company also advises revoking refresh tokens, forcing reauthentication, and temporarily disabling accounts suspected of compromise to prevent further attacks.