Microsoft Teams Up with Coinbase to Take Down EvilTokens Phishing Platform
Microsoft's Digital Crimes Unit (DCU) has partnered with Coinbase, Cloudflare, OpenAI, Railway, SpyCloud, Shadowserver Foundation, TRM Labs, and Health-ISAC to shut down 50 websites of the AI-driven "Phishing-as-a-Service" platform EvilTokens through a civil lawsuit authorized by the U.S. District Court for the Eastern District of Virginia. Over 175 associated domain names have also been disabled. This marks the 40th court-authorized cybercrime action in the history of Microsoft DCU and its first targeting AI-enabled criminal services.
The technical core of EvilTokens abuses Microsoft's OAuth 2.0 device authorization login process to initiate "device code phishing," allowing it to bypass multi-factor authentication and silently impersonate victims to log into Microsoft 365 applications. The platform is distributed by the threat group Storm-2992 via Telegram bots, offering 44 customizable phishing toolkits at a subscription price of $500 per month or a one-time fee of $1,500. The criminal group has also deployed AI chatbots to analyze compromised email accounts, automatically sorting trust relationships, identifying who has payment authority, and determining which targets are easiest to exploit. Using a "vibe coded" method, they generate attack tool code directly with AI, significantly lowering the technical barrier.
Since its launch in February 2026, EvilTokens has rapidly expanded. Microsoft Security Vice President Tanmay Ganacharya stated that as of March 15, the platform has averaged 10 to 15 new phishing activities every 24 hours. To date, it has compromised over 12,000 Microsoft 365 email accounts, affecting more than 10,000 organizations globally, with concentrated victims in the U.S., Canada, the U.K., Australia, India, and France, spanning industries including financial services, healthcare, and higher education.
Coinbase's global intelligence team independently tracked on-chain fund flows and found that EvilTokens received approximately $1.1 million in "platform fees" through four Tron addresses from October 2025 to June 2026, involving over 1,000 deposits from more than 700 different addresses. The team also investigated the identities of users who purchased the phishing toolkits on the Coinbase platform and provided relevant evidence to law enforcement, supporting Microsoft's civil lawsuit.
On September 18, the Metropolitan Police of London executed search warrants in Canary Wharf and Nine Elms, arresting two men aged 32 and 38, suspected of being operators of the EvilTokens website. They have since been released on bail, and the investigation is ongoing.
From a financial perspective, EvilTokens' revenue is essentially from "selling tools" rather than direct fraud—Storm-2992 profits by charging subscription fees to downstream criminals, with funds circulating through multiple addresses on the Tron blockchain. The actual financial losses are borne by end users induced to transfer funds by phishing emails. Coinbase has stated that its account system and credentials were not breached, and the lost funds came from customers who were socially engineered into voluntarily transferring cryptocurrency, with losses occurring outside the platform during user decision-making. The direct beneficiaries of this joint crackdown are Microsoft and Coinbase, among other participating organizations, as the evidence seized strengthens their security reputation and subsequent law enforcement authority. The pressured parties are Storm-2992 and the group of buyers of its phishing toolkits, whose identity information has been handed over to law enforcement.
According to independent security vendor SpyCloud, the actual scale of EvilTokens' impact is larger than the official figures disclosed by Microsoft—affecting 79 countries and 8,708 compromised accounts under 6,585 corporate email domains, with 97.5% of victims being corporate domain accounts rather than personal emails.
Source: Public Information
ABAB AI Insight
This is the 40th time Microsoft's Digital Crimes Unit has initiated a cybercrime infrastructure crackdown through court authorization. Over the past decade, the DCU has dismantled the Necurs botnet, TrickBot distribution network, and multiple lawsuits against the abuse of cracked Cobalt Strike, consistently opting for civil lawsuits to quickly obtain court authorization to directly seize domains and servers, bypassing lengthy criminal procedures. Coinbase's role is also traceable; its global intelligence team has previously collaborated with law enforcement to track the cryptocurrency laundering paths of North Korea's Lazarus Group. The on-chain evidence collection against EvilTokens is a continuation of its strategy to "leverage exchange data to support law enforcement."
In terms of funding pathways, Storm-2992 chose not to commit fraud directly but to package phishing tools as a subscription service for other criminals, with a pricing structure of $500 per month or $1,500 for a one-time purchase. This essentially represents a SaaS business model, where the customers are fraudsters. The funds are settled on the Tron blockchain, chosen for its low fees and fast transaction times, facilitating rapid dispersal of small amounts after frequent collections. This "selling tools rather than scams" approach monetizes technical development capabilities into replicable cash flow while shifting legal risks onto downstream purchasers and those executing the fraud.
In comparison, EvilTokens is not an isolated case. The LabHost phishing-as-a-service platform dismantled by international law enforcement in 2024 served over 40,000 criminal users at its peak and generated thousands of phishing domains, with a business model highly similar to EvilTokens. Earlier phishing tool markets like 16Shop and ONNX Store followed the same logic. The uniqueness of EvilTokens lies in its pioneering integration of generative AI at both ends of the criminal supply chain—using AI for front-end target selection and script generation, and for back-end attack code development, marking a shift in phishing-as-a-service from a "human workshop" phase to an "AI automated assembly line" phase.
The essence of this incident is technological substitution—AI is replacing the previously scarce human social engineering skills, compressing tasks that once required experienced fraudsters, such as mapping trust relationships, determining who can approve payments, and crafting convincing scripts, into an automated process. This allows individuals with almost no technical background to initiate high-quality attacks simply by paying for a subscription. The mechanism at play is that the core barrier to social engineering fraud was originally "high labor costs and difficult-to-replicate experience," and large language models excel at handling tasks based on text and relationship mapping. Once this barrier is breached by AI, criminal capabilities can be packaged, priced, and distributed on a subscription basis, prompting law enforcement strategies to shift from "catching every user" to "dismantling the infrastructure and payment channels that provide the tools."
ABAB News · Cognitive Laws
Every time the technical barrier lowers, a new batch of criminals emerges.
Once crime is wrapped in a subscription model, it will expand exponentially.
When you can't catch all the buyers, start by dismantling the sellers' stalls.