Breaking

Microsoft-Led Coalition Disrupts AI Phishing Service EvilTokens as UK Police Arrest Two Men

September 22, 2026 at 20:31 EDT

Security
AI Agents

A Microsoft-led coalition has disrupted EvilTokens, an AI-enabled phishing-as-a-service platform linked to more than 12,000 compromised inboxes at over 10,000 organizations worldwide, while UK police arrested two men on suspicion of offenses connected with the operation. Coinbase's role focused on tracing cryptocurrency payments and helping investigators connect the service to alleged operators and purchasers.

Sep 22, 2026 · AI phishing disruption

EvilTokens Takedown

A Microsoft-led coalition disrupted an AI-enabled phishing service that turned compromised inboxes into fraud targeting workflows.

12,000+

compromised inboxes

10,000+

organizations affected

$1.1M

platform revenue traced

men arrested in the UK

Infrastructure Removed

Each block represents about 10 web assets.

websites seized

150+

domains disabled

Attack Flow

Lure

invoice, file or voicemail prompt

→

Code

victim enters code on real sign-in

→

Tokens

attacker gains cloud session access

→

AI triage

inbox analysis flags fraud targets

Why It Matters

The operation combined legal action, identity telemetry and blockchain tracing to remove a commercial AI fraud platform.

What Remains

Similar phishing kits still exist, and stolen sessions must be revoked rather than treated like ordinary password theft.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.