{"id":13609,"date":"2026-09-23T10:45:55","date_gmt":"2026-09-23T10:45:55","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=13609"},"modified":"2026-09-23T10:45:55","modified_gmt":"2026-09-23T10:45:55","slug":"coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=13609","title":{"rendered":"Coinbase traced $1.1 million crypto trail behind AI phishing service EvilTokens"},"content":{"rendered":"

<\/p>\n

\n

Microsoft and Coinbase helped dismantle EvilTokens, an AI phishing service tied to more than 12,000 compromised inboxes worldwide.<\/p>\n

The operation had reached more than 10,000 organizations within months of launching, spanning financial services, real estate, healthcare, construction and other industries, Microsoft said.<\/p>\n

The company and its partners seized 50 websites used by EvilTokens and disabled more than 150 related domains, while UK police arrested two men on Sept. 11 on suspicion of offenses connected to the alleged operation. Police later released both on conditional bail.<\/p>\n

EvilTokens’ phishing service relied on AI use<\/h2>\n

EvilTokens had packaged much of the business-email-compromise process into a subscription service sold through Telegram. Microsoft said customers paid a $1,500 initiation fee and $500 recurring subscription for tools that combined account compromise, mailbox access, reconnaissance, and AI-assisted fraud preparation in a single interface.<\/p>\n

The service\u2019s entry point relied on Microsoft\u2019s device-code authentication, a legitimate sign-in flow designed for hardware such as smart TVs and conferencing equipment that cannot easily support standard browser logins.<\/p>\n

Attackers initiated the authentication request themselves, then sent the resulting code to targets through phishing emails disguised as invoices, shared files, and other routine business communications.<\/p>\n

Victims who entered that code on Microsoft\u2019s legitimate website effectively approved the session waiting on the attacker\u2019s device.<\/p>\n

The process could still require a password and multifactor authentication when the user was signed out, but those credentials remained on Microsoft\u2019s infrastructure. The process generated authorization for the attacker-initiated session.<\/p>\n

That gave EvilTokens something more useful than a stolen password: an authenticated foothold inside the mailbox. The platform then automated work that has traditionally required attackers to spend hours reading correspondence and reconstructing how an organization moves money.<\/p>\n

\"Three-step\"Three-step<\/p>\n

Its AI tools could translate and summarize messages, identify reporting lines and trusted contacts, surface pending invoices and wire-transfer conversations, and determine which employees had authority over payments.<\/p>\n