Coinbase's Global Intelligence team tracked approximately $1.1 million in revenue for the EvilTokens platform across four Tron addresses between October 2025 and June 2026. The AI-powered phishing service abused Microsoft’s legitimate device-login flow to authorize attacker sessions, then used AI to identify payment authorities within captured mailboxes. Microsoft and Coinbase collaborated to dismantle the operation, which had affected over 10,000 organizations. UK police arrested two men on Sept. 11 in connection with the alleged operation, who were later released on conditional bail.