Coinbase Helps Combat AI Phishing Platform EvilTokens, Operator Arrested

TechFlow reports that on September 23, Coinbase disclosed that its Global Intelligence Team assisted law enforcement agencies in combating the phishing-as-a-service platform EvilTokens. This platform utilizes artificial intelligence to analyze victims' email accounts and circumvents multi-factor authentication via Microsoft's device code login mechanism to carry out business email compromise and fund transfer fraud.

Coinbase tracked approximately $1.1 million in revenue flowing through four addresses on the TRON blockchain between October 2025 and June 2026, and assisted in identifying the platform's operators and clients. The UK Metropolitan Police arrested the relevant operators on September 11; Microsoft subsequently seized 50 websites through civil litigation and disabled over 175 related domains.