EvilTokens operators arrested; more than 175 associated domains deactivated

AT A GLANCE

Coinbase says it assisted Microsoft and other organizations in combating AI the phishing platform EvilTokens; the operation seized 50 websites, deactivated more than 175 domains, and led to the operators' arrest.

Article

Coinbase joins Microsoft in cracking down on AI the phishing platform EvilTokens; over 175 related domains disabled

PANews September 23 reported that, according to Coinbase’s official disclosure, it collaborated with Microsoft and several organizations to combat AI the -driven cybercrime platform EvilTokens. The platform provides “phishing-as-a-service” through Telegram bots, using AI AI to analyze trust relationships and payment authorizations in compromised email accounts, and leveraging Microsoft’s device code sign-in flow to bypass multi-factor authentication. Coinbase’s Global Intelligence team tracked and found that, 2025 year October to 2026 year June during the period, EvilTokens obtained approximately 4 in revenue through Tron addresses, involving more than 1100000 USD in deposits from 700 different addresses. The relevant evidence supported Microsoft’s civil lawsuit, ultimately leading to the seizure of 1000 websites and the disabling of more than 50 associated domains. The Metropolitan Police Service arrested the relevant operators on 175 and seized digital devices...

(Click the link below to read the full article) 🔗September 11 arrested the relevant operators and seized digital devices...

(Click the link below to read the full article) 🔗https://www.panewslab.com/zh/articles/01a0c9d8-e547-779c-9fcc-29b5e44ee321

Key points

Coinbase joins Microsoft to combat AI the phishing platform EvilTokens; more than 175 associated domains deactivated
PANews September 23 the -driven cybercrime platform EvilTokens. The platform provides “phishing-as-a-service” through Telegram bots, using AI-driven cybercrime platform EvilTokens. The platform provides “phishing-as-a-service” through Telegram bots, using AI year 2025 to October year 2026 during the period, EvilTokens obtained approximately June in revenue through Tron addresses, involving more than 4 in deposits from 1100000 USD different addresses. The relevant evidence supported Microsoft’s civil lawsuit, ultimately leading to the seizure of 700 websites and the disabling of more than 1000 associated domains. The Metropolitan Police Service arrested the relevant operators on 50 and seized digital devices... 175 associated domains were disabled. The Metropolitan Police Service has September 11 arrested the relevant operators and seized digital devices...
(Click the link below to read the full article.)
🔗 https://www.panewslab.com/zh/articles/01a0c9d8-e547-779c-9fcc-29b5e44ee321

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

No additional explanation is available beyond the summary.

Why it matters to readers

The report cites an official Coinbase disclosure and includes verifiable developments such as Microsoft's civil lawsuit, domain deactivations, and police arrests; this is a detailed update on the existing EvilTokens takedown, not an independent event. The event strengthens the industry's anti-phishing capabilities but has limited direct market impact on major cryptoassets.

Watch for subsequent official information and do not make decisions based on a single report.

Risks and unknowns

Subsequent rulings in Microsoft's civil lawsuit and asset recovery
The outcome of the UK's prosecution of the arrested operators
Whether the seized domains have migrated or resumed operations
Whether Coinbase has disclosed the number of affected users and the scale of losses

AT A GLANCE

Article

Coinbase joins Microsoft in cracking down on AI the phishing platform EvilTokens; over 175 related domains disabled

(Click the link below to read the full article) 🔗September 11 arrested the relevant operators and seized digital devices...

(Click the link below to read the full article) 🔗https://www.panewslab.com/zh/articles/01a0c9d8-e547-779c-9fcc-29b5e44ee321

Key points

Coinbase joins Microsoft to combat AI the phishing platform EvilTokens; more than 175 associated domains deactivated
PANews September 23 the -driven cybercrime platform EvilTokens. The platform provides “phishing-as-a-service” through Telegram bots, using AI-driven cybercrime platform EvilTokens. The platform provides “phishing-as-a-service” through Telegram bots, using AI year 2025 to October year 2026 during the period, EvilTokens obtained approximately June in revenue through Tron addresses, involving more than 4 in deposits from 1100000 USD different addresses. The relevant evidence supported Microsoft’s civil lawsuit, ultimately leading to the seizure of 700 websites and the disabling of more than 1000 associated domains. The Metropolitan Police Service arrested the relevant operators on 50 and seized digital devices... 175 associated domains were disabled. The Metropolitan Police Service has September 11 arrested the relevant operators and seized digital devices...
(Click the link below to read the full article.)
🔗 https://www.panewslab.com/zh/articles/01a0c9d8-e547-779c-9fcc-29b5e44ee321

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

No additional explanation is available beyond the summary.

Why it matters to readers

Watch for subsequent official information and do not make decisions based on a single report.

Risks and unknowns

Subsequent rulings in Microsoft's civil lawsuit and asset recovery
The outcome of the UK's prosecution of the arrested operators
Whether the seized domains have migrated or resumed operations
Whether Coinbase has disclosed the number of affected users and the scale of losses

EvilTokens operators arrested; more than 175 associated domains deactivated

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

EvilTokens operators arrested; more than 175 associated domains deactivated

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

Keep following

Security Center