Introduction

Microsoft and Coinbase have taken down a sophisticated phishing operation called EvilTokens, which used artificial intelligence to target businesses. The takedown resulted in arrests and seized infrastructure, marking a significant step in combating AI-enhanced cybercrime.

What Happened

Security researchers from Microsoft and Coinbase spent months tracking EvilTokens, a phishing-as-a-service kit sold on Telegram. The tool allowed attackers to send highly realistic fake emails, with an AI analyst that mapped payment roles and identified high-value targets. The operation evolved beyond typical spray-and-pray tactics. On September 11, UK police arrested two suspects, aged 32 and 38, on suspicion of fraud and money laundering. Authorities also seized 50 websites and disabled 175 domains linked to the network. Over $1.1 million was stolen from more than 700 victims between October 2025 and June 2026, with payments funneled through cryptocurrency wallets on the Tron blockchain.

  • Over $1.1 million was stolen from more than 700 victims between October 2025 and June 2026.
  • Payments were funneled through cryptocurrency wallets on the Tron blockchain.
  • Law enforcement seized 50 websites and disabled 175 domains linked to the network's infrastructure.

Why This Matters

The EvilTokens case demonstrates how artificial intelligence is lowering the barrier for cybercriminals, enabling non-technical actors to launch sophisticated phishing campaigns. By combining intelligence sharing with legal action, Microsoft, Coinbase, and police set a new precedent for industry-led cyber enforcement. The disruption also reveals that the perpetrators were already developing newer tools to target other platforms, underscoring the relentless pace of evolution in the threat landscape.

Key Takeaways

  • EvilTokens kits were sold for $100 to $300 per month on Telegram, often with customization options.
  • The AI-powered analyst feature mapped trusted relationships and flagged high-value payment targets.
  • Two suspects were arrested and released on bail as the investigation continues.
  • More than $1.1 million was stolen from victims, with crypto traced to over 700 Tron blockchain addresses.
  • The cross-industry partnership between Microsoft, Coinbase, and law enforcement offers a model for future cybercrime responses.

Conclusion

As cybercriminals increasingly automate their attacks, collaborations between tech giants and law enforcement will be essential to staying ahead. Businesses should verify unexpected payment requests, enforce strong multi-factor authentication, and stay informed about emerging threats. The EvilTokens takedown shows that even sophisticated, AI-powered operations can be disrupted when industries unite.