Coinbase collaborates with Microsoft to combat AI phishing platform EvilTokens: over 175 associated domain names have been disabled

According to official disclosures from Coinbase, it has collaborated with Microsoft and several institutions to combat the AI-driven cybercrime platform EvilTokens. This platform offers "phishing as a service" through Telegram bots, utilizing AI to analyze trust relationships and payment permissions in compromised email accounts, and bypassing multi-factor authentication through Microsoft's device code login process.

The Coinbase global intelligence team tracked that between October 2025 and June 2026, EvilTokens generated approximately $1.1 million in revenue through four Tron addresses, involving over 1,000 deposits from more than 700 different addresses. The related evidence supported Microsoft's civil lawsuit, ultimately leading to the seizure of 50 websites and the deactivation of over 175 associated domain names. The Metropolitan Police Service of the United Kingdom arrested the relevant operators and seized digital devices on September 11. Coinbase stated that this incident did not result in the leakage of Coinbase accounts or credentials, but some customers were manipulated into transferring cryptocurrency to the scammers' addresses through phishing emails.