Current outcome
EvilTokens infrastructure has been dismantled, with related websites and domains seized/disabled; Coinbase traced about $1.1 million in platform revenue; two suspects were arrested and released on conditional bail; Microsoft warned the same authentication abuse and AI-assisted fraud model can still be reused.
Progress timeline
2 material updates- #01
Microsoft and Coinbase probe leads to arrest of crooks behind 'EvilTokens', a DIY phishing network powered by AI - fortune.com
Source evidence: fortune.com
- #02
Coinbase traced $1.1 million crypto trail behind AI phishing service EvilTokens
New facts: Coinbase traced about $1.1 million in EvilTokens platform revenue across four Tron addresses from October 2025 to June 2026; the phishing service compromised over 12,000 inboxes across more than 10,000 organizations; authorities seized 50 websites and disabled over 150 related domains; UK police arrested two suspects on Sept. 11, later released on conditional bail.
State after update: EvilTokens infrastructure has been dismantled, with related websites and domains seized/disabled; Coinbase traced about $1.1 million in platform revenue; two suspects were arrested and released on conditional bail; Microsoft warned the same authentication abuse and AI-assisted fraud model can still be reused.
Source evidence: CryptoSlate