Coinbase traces about $1.1 million trail from EvilTokens phishing service

Coinbase traced about $1.1 million in revenue from EvilTokens, an AI phishing service. Coinbase found the revenue across four Tron addresses between October 2025 and June 2026. The service received more than 1,000 deposits from over 700 distinct addresses. The revenue represented payments to EvilTokens rather than funds stolen from phishing victims. Microsoft and Coinbase helped dismantle the service. EvilTokens was linked to more than 12,000 compromised inboxes worldwide. Microsoft said the service reached more than 10,000 organizations within months of launching. The operation affected financial services, real estate, healthcare, construction and other industries. Microsoft and its partners seized 50 websites used by EvilTokens. They disabled more than 150 related domains. UK police arrested two men on Sept. 11 on suspicion of offenses connected to the alleged operation. Police later released both men on conditional bail. EvilTokens sold its tools through Telegram as a subscription service. Microsoft said customers paid a $1,500 initiation fee. Customers also paid a $500 recurring subscription. The service used Microsoft's device-code authentication process to gain access to mailboxes. Attackers sent authentication codes through phishing emails disguised as invoices or shared files. Users who entered the codes approved sessions initiated on the attackers' devices. EvilTokens used AI tools to translate and summarize messages. The tools also identified trusted contacts and employees with payment authority. Microsoft said preset prompts helped identify an organization's money movers and recommend people to impersonate. Investigators found evidence that AI-assisted coding tools helped build parts of EvilTokens. Coinbase combined transaction data with merchant records, device information and open-source intelligence to help attribute the service to its alleged operators. Coinbase referred the matter to London's Metropolitan Police. The exchange also referred cases involving EvilTokens purchasers to law enforcement. Coinbase's evidence contributed to Microsoft's civil action against the service. Some Coinbase users sent cryptocurrency to scam-controlled addresses after attackers compromised email conversations. Coinbase accounts and credentials were not compromised. Coinbase said the operator planned to extend the toolkit to Gmail and Okta accounts. Microsoft warned that removing the current infrastructure would not eliminate the method. Microsoft recommends blocking device-code authentication where it is unnecessary. Microsoft advises organizations to restrict the process where it is operationally required. For suspected compromises, Microsoft advises revoking refresh tokens and forcing reauthentication. Microsoft said standard session revocation may leave existing access tokens usable for up to an hour.