UK police arrested the operators of an AI-powered phishing platform on September 11, 2026, as part of a global effort to shut down EvilTokens. Microsoft and Coinbase partnered with Cloudflare and TRM Labs to dismantle the infrastructure, which compromised more than 12,000 inboxes across 10,000 organizations. The service exploited Microsoft's device-code sign-in flow and utilized artificial intelligence to identify trusted contacts and draft impersonation emails.

The joint operation seized 50 websites and over 175 domains, while investigators traced $1.1 million in revenue on the Tron blockchain. EvilTokens operated as a phishing-as-a-service platform on Telegram that automated target selection and email harvesting for business email compromise scams. Coinbase reported that none of its own user accounts were compromised during the activity.