Coinbase and Microsoft Help Disrupt EvilTokens, an AI-Branded Phishing Service
• From trending topic: Coinbase and Microsoft Dismantle AI Phishing Platform EvilTokens
Summary
Coinbase said it partnered with Microsoft to disrupt EvilTokens, which it described as an AI-powered cybercrime platform. According to that account, Coinbase joined a broader effort that investigated infrastructure, took down domains, and helped police arrest people it identified as the operators.
A second strand of the same discussion, not independently documented in the material driving the trend, holds that EvilTokens appeared in February 2026 and quickly became one of the most widely used phishing-as-a-service platforms. Those descriptions say it supported device-code phishing meant to compromise organizational accounts at scale. Coinbase’s own post did not, in the circulated wording, specify victim counts, the operators’ identities or locations, or what “AI-powered” meant in technical terms.
What is public so far is a corporate claim of a joint disruption plus a sketch of a commercial phishing kit. Device-code attacks typically depend on tricking someone into completing a login step the attacker can see. Whether EvilTokens mainly hit crypto users, cloud workplace accounts, or both is not established in the posts themselves. The arrests, domain seizures, and the platform’s actual market position remain details that law-enforcement and company technical write-ups would need to confirm.
Common Perspectives
Takedowns like this are how fast crime gets answered
Security teams, exchange customers, and researchers who watch phishing kits tend to treat the announcement as good news. Phishing-as-a-service already packages sophisticated lures for people who cannot build them; a named, widely used panel is a concrete target. The appeal is practical: Microsoft and Coinbase sit on traffic, abuse reports, and infrastructure that police often reach late. The assumption is that seizing domains and helping with arrests actually removes capacity rather than scattering it. The trade-off is that the same firms decide which platforms count as urgent, usually those that threaten their own users and brands.
The speed of the kit is the AI story
People who follow AI misuse read the February-to-September arc as the point. If the “widely used” claim holds, a service went from emergence to heavy adoption in months, with generative tools in the marketing if not the code. That view appeals because it fits a larger fear that crimeware now iterates like product software. It assumes “AI-powered” changed capability rather than just the sales pitch. The trade-off is policy energy spent on model access and branding, when the underlying trick—getting a person to finish an authentication flow—predates this kit.
Two large companies should not be the raid team
Digital-rights advocates and operators who distrust concentrated platform power hear “investigating infrastructure” and “taking down domains” as private policing. Microsoft and Coinbase are not courts. This view appeals to anyone who has seen overbroad seizures or unclear evidence standards in other takedowns. It assumes public process would constrain mistakes better than a joint corporate operation. The trade-off is delay: waiting for traditional cases can mean more compromised inboxes while a kit is still for sale.
Another phishing win does not fix crypto’s human layer
Some people in digital assets greet the news as Coinbase doing its job and still see account theft as the industry’s ordinary weather. Device-code and similar campaigns succeed because users can be rushed, not because one panel is uniquely clever. That stance appeals to veterans of seed-phrase and fake-support scams. It assumes this platform was meaningfully aimed at crypto or Coinbase’s orbit—an inference from who announced the disruption, not from a public victimology. The risk is treating a single brand’s funeral as progress while the same social-engineering market restocks.
A Different View
The dominant frame is a named enemy taken off the field. A quieter issue is the storefront model. Once phishing is rented, the logo on the panel is disposable. Buyers still want organizational credentials; someone else can stand up a new dashboard, reuse the same device-code pattern, and skip the AI label or lean into it. Domain takedowns and operator arrests matter if they raise the cost of running that store. They do less if the demand and the brittle login step remain. Coinbase and Microsoft also have a straightforward incentive to publicize a win against a threat that, if the descriptions are right, scaled against the kinds of accounts they are expected to protect. That does not make the disruption fake. It does mean the next kit will not need a new vulnerability—only a new name and a working payment channel.
Conclusion
What to watch is not another round of congratulations but primary detail: charging documents, a technical breakdown of the kit, and whether successor panels appear under different branding. Until those exist, EvilTokens is a disruption Coinbase and Microsoft say they achieved, wrapped in claims about AI and market share that have not yet been shown in public evidence.
Sources and discussion
These public posts were collected while researching this story. They provide context and reactions, but may not independently verify every claim.
View the original topic on XCoinbase 🛡️
@coinbase
We partnered with Microsoft to disrupt EvilTokens, an AI-powered cybercrime platform. Our team joined a global effort to dismantle its operations - investigating infrastructure, taking down domains, and helping police arrest its operators. Say goodbye to another major
Sep 22, 2026381 likes45 repostsMicrosoft Threat Intelligence
@MsftSecIntel
Since emerging in February 2026, EvilTokens quickly became one of the most widely used phishing-as-a-service (PhaaS) platforms, enabling sophisticated device code phishing campaigns aimed at compromising organizational accounts at scale.
Sep 22, 202675 likes20 reposts