Coinbase traced $1.1 million crypto trail behind AI phishing service EvilTokens
Microsoft, Coinbase and law enforcement disrupted EvilTokens, an AI-assisted phishing service linked to more than 12,000 compromised inboxes and attacks on over 10,000 organizations. Investigators seized 50 websites, disabled more than 150 domains and traced about $1.1 million in platform revenue across four Tron addresses. UK police arrested two men, later released on conditional bail. EvilTokens used phishing to exploit Microsoft’s device-code authentication, giving attackers mailbox access that its tools analyzed to identify payment decision-makers and prepare targeted fraud. Coinbase said its accounts and credentials were not compromised, though some customers were tricked into sending cryptocurrency. The operator had reportedly planned to expand the toolkit to Gmail and Okta. Microsoft advises restricting device-code sign-ins and revoking sessions after suspected compromise.
