Microsoft and Coinbase Smash AI-Powered Phishing Network That Defrauded Businesses
A sophisticated phishing network known as EvilTokens has been taken down by Microsoft and Coinbase after defrauding businesses out of $1.1 million between October 2025 and June 2026.
The do-it-yourself phishing kit, sold on Telegram for between $100 and $300 per month, used AI-powered analysis to map trusted relationships and identify who controlled payments.
Once a victim fell for the phishing email, scammers could use the AI analyst to create especially persuasive emails targeting those in position to pay. The EvilTokens tool was also able to bypass two-factor authentication and survive password resets.
The investigation culminated in the arrest of two men on suspicion of making articles for use in fraud and money laundering offenses. Microsoft filed civil lawsuits that resulted in the seizure of 50 websites and disabling of over 175 domains tied to EvilTokens' infrastructure.