Microsoft and Coinbase helped dismantle EvilTokens, an AI-powered phishing service that abused Microsoft’s device-code login to hijack user sessions, compromise over 12,000 inboxes across 10,000 organizations, and generate at least $1.1 million in crypto payments. EvilTokens packaged business-email-compromise into a subscription product sold via Telegram, charging initiation and recurring fees for tools that automated account takeover, mailbox access, reconnaissance, and AI-driven selection of payment authorities and impersonation opportunities. Authorities seized 50 EvilTokens websites, disabled more than 150 domains, and UK police arrested two suspects later released on conditional bail, while Microsoft warned the same authentication abuse and AI fraud model may be replicated by other actors.
This update represents a notable development in the Crypto sector. Organizations and founders tracking this space should evaluate potential strategic and technical implications on their operations.