AI Ethics
5d ago
Microsoft and Coinbase dismantle EvilTokens phishing network, leading to arrests
Sep 22, 2026
AI Summary
Microsoft and Coinbase have successfully taken down the EvilTokens phishing network, which exploited AI to enhance its attacks. Two suspects were arrested, and the operation is linked to over $1.1 million in fraudulent payments made through cryptocurrency.
- Microsoft and Coinbase collaborated to dismantle the EvilTokens phishing network, which targeted businesses through sophisticated AI-driven phishing kits sold on Telegram.
- The phishing kits allowed scammers to create highly convincing emails by analyzing trusted relationships and payment controls, making them more effective than traditional phishing methods.
- The investigation led to the arrest of two men, aged 32 and 38, on September 11, on charges related to fraud and money laundering, with the suspects currently released on bail.
- The EvilTokens operation reportedly generated around $1.1 million in fraudulent payments from over 700 distinct cryptocurrency addresses between October 2025 and June 2026.
- Microsoft also filed civil lawsuits resulting in the seizure of 50 websites and the disabling of more than 175 domains associated with EvilTokens.
- The investigation expanded to include other firms like Cloudflare and OpenAI, and at the time of the takedown, the perpetrators were developing new phishing tools targeting Okta and Gmail accounts.
phishingcybersecurityai ethicsscamssocial media