A coalition of technology companies acted on a federal court order on Sept. 15 to seize 50 websites and disable more than 175 domains used by an AI powered fraud network. The operation dismantled EvilTokens, a platform launched in February 2026 that used artificial intelligence at every step of the attack chain to design financial fraud roadmaps and compromise email accounts. The network targeted more than 10,000 organizations and hit over 12,000 inboxes by abusing Microsoft's legitimate device-code sign-in flow.

The disruption involved partners including Coinbase, Cloudflare, OpenAI, Railway, and TRM Labs, while UK police arrested the platform's operators on Sept. 11. Investigators traced $1.1 million in revenue on the Tron blockchain. While the platform's automated tools enabled business email compromise via automated harvesting and target selection, no Coinbase accounts were compromised.