Coinbase traces $1.1M to AI phishing service EvilTokens

Coinbase’s Global Intelligence team traced roughly $1.1 million in cryptocurrency payments to EvilTokens, an AI-assisted phishing subscription service. The tracing covered four Tron addresses and transactions between October 2025 and June 2026, identifying more than 1,000 deposits from over 700 distinct addresses. Coinbase treated those transactions as revenue paid to the service rather than the total amount stolen from victims.

EvilTokens operated as a subscription sold on Telegram. Customers paid a $1,500 initiation fee and a $500 recurring subscription for a package that bundled authenticated mailbox access, reconnaissance tools and fraud-preparation features. Investigators found the service reached more than 10,000 organizations across financial services, real estate, healthcare, construction and other industries.

The platform exploited Microsoft’s device-code authentication flow. Attackers started an authentication request and then sent the resulting code to targets in phishing emails disguised as invoices or shared files. When victims entered the code on Microsoft’s legitimate site, the pending session on the attacker’s device was approved. If a user was signed out, the flow could still require a password or multifactor prompt, but credentials remained on Microsoft’s infrastructure while the attacker received session authorization.

EvilTokens included AI features to speed tasks that normally take hours. The tools could translate and summarize messages, identify reporting lines and trusted contacts, surface pending invoices and wire-transfer discussions, and flag employees with payment authority. Preset prompts identified likely “money movers” and suggested targets to impersonate. Investigators also found indications that parts of the platform were developed with AI-assisted coding tools.

Microsoft and its partners disrupted the infrastructure used by EvilTokens, seizing 50 websites and disabling more than 150 related domains. UK police arrested two men on Sept. 11 on suspicion of offenses connected to the operation; both were later released on conditional bail. Coinbase combined transaction records with merchant data, device information and open-source intelligence to map payment flows and referred its findings to London’s Metropolitan Police. The exchange also identified some purchasers on its platform and referred those accounts to law enforcement; its evidence fed into Microsoft’s civil action against the service.

Coinbase found some users were manipulated through compromised email conversations into sending cryptocurrency to scam-controlled addresses; Coinbase accounts and credentials were not compromised. The service’s operator signaled plans to expand the toolkit to other identity platforms, including Gmail and Okta. Microsoft advised organizations to block device-code authentication where unnecessary and to restrict it where required. For suspected compromises, Microsoft recommended revoking refresh tokens, forcing reauthentication and, in some cases, temporarily disabling accounts, noting that standard session revocation can leave existing access tokens valid for up to an hour.