Full Breakdown
Microsoft and Coinbase Disrupt EvilTokens Phishing Network
By Drooid · · How we work
How EvilTokens Operated
EvilTokens offered a do-it-yourself phishing kit on Telegram that targeted Microsoft Outlook accounts. The kit featured an “AI-powered analyst” that mapped trusted relationships, identified payment authorities, and highlighted likely fraud points, allowing scammers to craft highly persuasive follow-up emails after an initial compromise. Victims were directed to counterfeit Microsoft or DocuSign pages that displayed a code, which, when entered on a legitimate Microsoft site, let the malware bypass two-factor authentication and persist even after password resets. The service required minimal technical skill, enabling operators to run attacks at industrial scale.
Financial Impact and Scale
Coinbase’s security team reported that the kit was rented for $100-$300 per month. Between October 2025 and June 2026, investigators traced roughly $1.1 million in cryptocurrency payments to wallets on the Tron blockchain, originating from more than 700 distinct addresses. The Metropolitan Police arrested two men, aged 32 and 38, on suspicion of producing articles for fraud and money-laundering offenses; both were released on bail while the investigation continues.
Official Responses and Legal Action
Microsoft and Coinbase collaborated for months, sharing intelligence before handing findings to law enforcement. The investigation culminated on September 11, when the Metropolitan Police seized the perpetrators. Microsoft subsequently filed civil lawsuits that led to the seizure of 50 websites and the disabling of over 175 domains tied to EvilTokens’ infrastructure, posting a public splash page on the reclaimed sites. The takedown effort broadened to include Cloudflare and OpenAI as part of a wider anti-phishing coalition. Coinbase noted that the arrested individuals were already developing new tools aimed at Okta and Gmail accounts.
Verbatim Quotes
- “It completely obliterates the barrier to entry on phishing as a service, and can be operated on an industrial scale,” — Charlotte Surrey