Microsoft and Coinbase probe leads to arrest of crooks behind ‘EvilTokens’, a DIY phishing network powered by AI

Microsoft and Coinbase jointly announced the dismantling of a phishing network called "EvilTokens" on Tuesday. The network, which defrauded businesses including real estate firms, banks, and healthcare providers, operated an AI-powered tool that identified trusted relationships, detected payment control, and pinpointed the most likely places for fraud to succeed.

This AI-powered system allowed scammers to craft especially convincing emails to defraud victims after they fell for phishing emails. The EvilTokens tool proved particularly difficult to eradicate, as it could bypass two-factor authentication and survive password resets. Its software, according to Coinbase, lowered the bar for phishing participation, making it possible for anyone to execute industrial-scale phishing attacks, even those with minimal technical skill.

Pricing for the kit on Telegram ranged from $100 to $300 per month. The investigation, part of an ongoing partnership between security teams at Coinbase and Microsoft, led to the arrest of the network's creators, a 32-year-old and a 38-year-old man, on suspicion of fraud and money laundering offenses. They were released on bail as the investigation continues.

The two men were responsible for stealing around $1.1 million in cryptocurrency from over 700 addresses. Microsoft also filed civil lawsuits that led to the seizure of 50 websites and the disabling of over 175 domains associated with the network's infrastructure.