{"id":565164,"date":"2026-09-23T11:20:37","date_gmt":"2026-09-23T10:20:37","guid":{"rendered":"https:\/\/cryptoslate.com\/?p=565164"},"modified":"2026-09-23T10:05:29","modified_gmt":"2026-09-23T09:05:29","slug":"coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens","status":"publish","type":"post","link":"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/","title":{"rendered":"Coinbase traced $1.1 million crypto trail behind AI phishing service EvilTokens"},"content":{"rendered":"<p>Microsoft and <a href=\"https:\/\/cryptoslate.com\/companies\/coinbase\/\">Coinbase<\/a> helped dismantle EvilTokens, an AI phishing service tied to more than 12,000 compromised inboxes worldwide.<\/p>\n<p>The operation had reached more than 10,000 organizations within months of launching, spanning financial services, real estate, healthcare, construction and other industries, Microsoft <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2026\/09\/22\/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing\/\">said<\/a>.<\/p>\n<p>The company and its partners seized 50 websites used by EvilTokens and disabled more than 150 related domains, while UK police arrested two men on Sept. 11 on suspicion of offenses connected to the alleged operation. Police later released both on conditional bail.<\/p>\n<h2>EvilTokens' phishing service relied on AI use<\/h2>\n<p>EvilTokens had packaged much of the <a href=\"https:\/\/cryptoslate.com\/attackers-exploit-fake-stm32-vulnerability-alert-to-target-trezor-and-bitbox-holders\/\">business-email-compromise<\/a> process into a subscription service sold through <a href=\"https:\/\/cryptoslate.com\/companies\/telegram\/\">Telegram<\/a>. Microsoft said customers paid a $1,500 initiation fee and $500 recurring subscription for tools that combined account compromise, mailbox access, reconnaissance, and AI-assisted fraud preparation in a single interface.<\/p>\n<p>The service\u2019s entry point relied on Microsoft\u2019s device-code authentication, a legitimate sign-in flow designed for hardware such as smart TVs and conferencing equipment that cannot easily support standard browser logins.<\/p>\n<p>Attackers initiated the authentication request themselves, then sent the resulting code to targets through <a href=\"https:\/\/cryptoslate.com\/crypto-industry-alarmed-as-7-million-opensea-email-users-leak-resurfaces\/\">phishing emails<\/a> disguised as invoices, shared files, and other routine business communications.<\/p>\n<p>Victims who entered that code on Microsoft\u2019s legitimate website effectively approved the session waiting on the attacker\u2019s device.<\/p>\n<p>The process could still require a password and multifactor authentication when the user was signed out, but those credentials remained on Microsoft\u2019s infrastructure. The process generated authorization for the attacker-initiated session.<\/p>\n<p>That gave EvilTokens something more useful than a stolen password: an authenticated foothold inside the mailbox. The platform then automated work that has traditionally required attackers to spend hours reading correspondence and reconstructing how an organization moves money.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-565165\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-c4ca0341-445e-4877-b0d4-6f2ff11d51f1.png\" alt=\"Three-step device-code phishing flow showing an attacker starting a session, a victim entering the attacker-supplied code, and the attacker receiving the authorized session, followed by token revocation and temporary account disablement guidance.\" width=\"720\" height=\"405\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-c4ca0341-445e-4877-b0d4-6f2ff11d51f1.png 1672w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-c4ca0341-445e-4877-b0d4-6f2ff11d51f1-300x169.png 300w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-c4ca0341-445e-4877-b0d4-6f2ff11d51f1-1024x576.png 1024w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-c4ca0341-445e-4877-b0d4-6f2ff11d51f1-768x432.png 768w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-c4ca0341-445e-4877-b0d4-6f2ff11d51f1-1536x864.png 1536w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-c4ca0341-445e-4877-b0d4-6f2ff11d51f1-480x270.png 480w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-c4ca0341-445e-4877-b0d4-6f2ff11d51f1-1200x675.png 1200w\" sizes=\"(max-width: 720px) 100vw, 720px\" \/><\/p>\n<p>Its AI tools could translate and summarize messages, identify reporting lines and trusted contacts, surface pending invoices and wire-transfer conversations, and determine which employees had authority over payments.<\/p>\n<p>Microsoft said preset prompts could identify an organization\u2019s \u201cmoney movers\u201d and recommend people to impersonate, letting customers move from account access to targeted fraud with far less manual reconnaissance.<\/p>\n<p>Investigators also found evidence that parts of EvilTokens were built with <a href=\"https:\/\/cryptoslate.com\/hp-says-fake-ai-trading-bot-swapped-crypto-wallet-extensions-for-credential-stealing-copies\/\">AI-assisted coding tools<\/a>, lowering the technical burden on both sides of the operation.<\/p>\n\n<div class=\"cs-article-embed\">\n    <a href=\"https:\/\/cryptoslate.com\/ai-was-supposed-to-take-scammers-jobs-but-it-gave-them-superpowers-instead\/\" class=\"cs-article-embed__link\">\n        <div class=\"cs-article-embed__body\">\n            <span class=\"cs-article-embed__related-reading\">Related Reading<\/span>\n            <h3 class=\"cs-article-embed__title\">AI was supposed to take scammers\u2019 jobs, but it gave them superpowers instead<\/h3>\n        <\/div>\n        <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\">\n            <i class=\"fa-light fa-arrow-up-right\"><\/i>\n        <\/span>\n    <\/a>\n<\/div>\n\n<p>The result was a service that could help less-skilled customers gain access to an account, understand its contents, and prepare an impersonation campaign without assembling each capability separately.<\/p>\n<h2>Crypto payments gave investigators a trail<\/h2>\n<p>The subscription model also created the financial trail Coinbase used to work backward through the operation.<\/p>\n<p>Coinbase\u2019s Global Intelligence team <a href=\"https:\/\/www.coinbase.com\/blog\/taking-down-evil-tokens\">traced<\/a> about $1.1 million in EvilTokens platform revenue across four <a href=\"https:\/\/cryptoslate.com\/blockchain\/tron\/\">Tron<\/a> addresses between October 2025 and June 2026. It identified more than 1,000 deposits from over 700 distinct addresses and mapped flows from payments into EvilTokens through their eventual cash-out destinations. The figures represent revenue paid to the service rather than the amount ultimately stolen from phishing victims.<\/p>\n<p>Coinbase said it combined transaction data with merchant records, device information and open-source intelligence to help attribute the platform to its alleged operators before referring the matter to London\u2019s Metropolitan Police.<\/p>\n<p>The exchange also investigated EvilTokens purchasers it identified on its own platform and referred those cases to law enforcement. Its evidence contributed to Microsoft\u2019s civil action against the service.<\/p>\n<p>Coinbase customers were also among those caught downstream. The exchange said some users were manipulated through compromised email conversations into sending cryptocurrency to scam-controlled addresses. Coinbase accounts and credentials were not compromised.<\/p>\n<p>The disruption interrupted an operation that was already looking beyond Microsoft. Coinbase said EvilTokens\u2019 operator had\u00a0<span style=\"box-sizing: border-box; margin: 0px; padding: 0px;\">signaled plans to extend the\u00a0<a href=\"https:\/\/cryptoslate.com\/phishing-scammers-now-exploiting-googles-infrastructure-to-target-crypto-users\/\" target=\"_blank\" rel=\"noopener\">toolkit to Gmail<\/a> and Okta accounts, potentially spreading<\/span>\u00a0the same model across other identity platforms.<\/p>\n<p>Microsoft warned that removing the service\u2019s current infrastructure would not eliminate the method. The company recommends organizations block device-code authentication where it is unnecessary and tightly restrict it where operationally required. For accounts suspected of compromise, it advises revoking refresh tokens, forcing reauthentication and, in some cases, temporarily disabling the account.<\/p>\n<p>That last step can carry a short-term operational cost, but Microsoft said standard session revocation may leave existing access tokens usable for up to an hour. Attackers have exploited that window in recent campaigns, leaving security teams to choose between brief disruption to legitimate users and continued access for someone already inside the mailbox.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>EvilTokens abused Microsoft\u2019s real device-login flow to authorize attacker sessions, then used AI to identify payment authorities inside captured mailboxes.<\/p>\n","protected":false},"author":720,"featured_media":565195,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[78326,76799,60208],"tags":[81114,76714,77040,77433],"prediction_market_topic":[],"post_folder":[],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v21.9 (Yoast SEO v21.9.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Coinbase traced $1.1 million crypto trail behind AI phishing service EvilTokens<\/title>\n<meta name=\"description\" content=\"Microsoft and Coinbase helped dismantle EvilTokens after it compromised more than 12,000 email accounts across 10,000 organizations.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Coinbase traced $1.1 million crypto trail behind AI phishing service EvilTokens\" \/>\n<meta property=\"og:description\" content=\"Microsoft and Coinbase helped dismantle EvilTokens after it compromised more than 12,000 email accounts across 10,000 organizations.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/\" \/>\n<meta property=\"og:site_name\" content=\"CryptoSlate\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-23T10:20:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-23T09:05:29+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/coinbase-ai-phishing-breach.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Oluwapelumi Adejumo\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cryptoslate\" \/>\n<meta name=\"twitter:site\" content=\"@cryptoslate\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Oluwapelumi Adejumo\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/\"},\"author\":{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/#person\",\"name\":\"Oluwapelumi Adejumo\",\"url\":\"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/\"},\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/#authorimage\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-oluwapelumi-adejumo-1-300x300.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-oluwapelumi-adejumo-1-300x300.jpg\",\"caption\":\"Oluwapelumi Adejumo\"},\"jobTitle\":\"Senior Reporter\",\"description\":\"Oluwapelumi values Bitcoin's potential. He imparts insights on a range of topics like DeFi, hacks, mining and culture, underlining transformative power.\",\"worksFor\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"sameAs\":[\"https:\/\/x.com\/hardeyjumoh\",\"https:\/\/www.linkedin.com\/in\/oluwapelumi-adejumo\",\"https:\/\/muckrack.com\/oluwapelumi-adejumo\"]},\"headline\":\"Coinbase traced $1.1 million crypto trail behind AI phishing service EvilTokens\",\"datePublished\":\"2026-09-23T10:20:37+00:00\",\"dateModified\":\"2026-09-23T10:20:37+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/\"},\"wordCount\":721,\"publisher\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"keywords\":[\"AI\",\"Coinbase\",\"Microsoft\",\"payments\"],\"articleSection\":[\"AI\",\"Crime\",\"Payments\"],\"inLanguage\":\"en-US\",\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/\",\"url\":\"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/\",\"name\":\"Coinbase traced $1.1 million crypto trail behind AI phishing service EvilTokens\",\"isPartOf\":{\"@id\":\"https:\/\/cryptoslate.com\/#website\"},\"datePublished\":\"2026-09-23T10:20:37+00:00\",\"dateModified\":\"2026-09-23T10:20:37+00:00\",\"description\":\"Microsoft and Coinbase helped dismantle EvilTokens after it compromised more than 12,000 email accounts across 10,000 organizations.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptoslate.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Coinbase traced $1.1 million crypto trail behind AI phishing service EvilTokens\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptoslate.com\/#website\",\"url\":\"https:\/\/cryptoslate.com\/\",\"name\":\"CryptoSlate\",\"description\":\"Cryptocurrency News and Real-time Coin Data\",\"publisher\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"inLanguage\":\"en-US\"},{\"@type\":\"NewsMediaOrganization\",\"@id\":\"https:\/\/cryptoslate.com\/#organization\",\"name\":\"CryptoSlate\",\"url\":\"https:\/\/cryptoslate.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg\",\"width\":1000,\"height\":1000,\"caption\":\"CryptoSlate\"},\"image\":{\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/twitter.com\/cryptoslate\",\"https:\/\/www.instagram.com\/cryptoslate\",\"https:\/\/www.linkedin.com\/company\/cryptoslate\",\"https:\/\/www.youtube.com\/c\/cryptoslate\",\"https:\/\/t.me\/cryptoslatenews\",\"https:\/\/www.crunchbase.com\/organization\/cryptoslate\",\"https:\/\/iq.wiki\/wiki\/cryptoslate\",\"https:\/\/news.google.com\/publications\/CAAqKggKIiRDQklTRlFnTWFoRUtEMk55ZVhCMGIzTnNZWFJsTG1OdmJTZ0FQAQ\",\"https:\/\/muckrack.com\/media-outlet\/cryptoslate\",\"https:\/\/www.tiktok.com\/@cryptoslatenews\"],\"publishingPrinciples\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles\",\"ownershipFundingInfo\":\"https:\/\/cryptoslate.com\/disclaimers\/how-cryptoslate-makes-and-spends-money\/\",\"correctionsPolicy\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback\",\"ethicsPolicy\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles\",\"foundingDate\":\"2017-08-04\",\"founder\":[{\"@type\":\"Person\",\"name\":\"Nate Whitehill\"},{\"@type\":\"Person\",\"name\":\"Matthew Blancarte\"}],\"contactPoint\":[{\"@type\":\"ContactPoint\",\"contactType\":\"customer support\",\"url\":\"https:\/\/cryptoslate.com\/contact\/\",\"availableLanguage\":\"en-US\"},{\"@type\":\"ContactPoint\",\"contactType\":\"sales\",\"url\":\"https:\/\/cryptoslate.com\/contact\/?topic=advertising#contact-form\",\"availableLanguage\":\"en-US\"},{\"@type\":\"ContactPoint\",\"contactType\":\"newsroom\",\"url\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback\",\"email\":\"tips@cryptoslate.com\",\"availableLanguage\":\"en-US\"}],\"masthead\":\"https:\/\/cryptoslate.com\/about\/#masthead\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/b333928a322ba4c082e8bb2ad0f14eb6\",\"name\":\"Oluwapelumi Adejumo\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-oluwapelumi-adejumo-1-150x150.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-oluwapelumi-adejumo-1-150x150.jpg\",\"caption\":\"Oluwapelumi Adejumo\"},\"description\":\"Oluwapelumi values Bitcoin's potential. He imparts insights on a range of topics like DeFi, hacks, mining and culture, underlining transformative power.\",\"jobTitle\":\"Reporter\",\"worksFor\":\"CryptoSlate\",\"url\":\"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Coinbase traced $1.1 million crypto trail behind AI phishing service EvilTokens","description":"Microsoft and Coinbase helped dismantle EvilTokens after it compromised more than 12,000 email accounts across 10,000 organizations.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/","og_locale":"en_US","og_type":"article","og_title":"Coinbase traced $1.1 million crypto trail behind AI phishing service EvilTokens","og_description":"Microsoft and Coinbase helped dismantle EvilTokens after it compromised more than 12,000 email accounts across 10,000 organizations.","og_url":"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/","og_site_name":"CryptoSlate","article_published_time":"2026-09-23T10:20:37+00:00","article_modified_time":"2026-09-23T09:05:29+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/coinbase-ai-phishing-breach.webp","type":"image\/webp"}],"author":"Oluwapelumi Adejumo","twitter_card":"summary_large_image","twitter_creator":"@cryptoslate","twitter_site":"@cryptoslate","twitter_misc":{"Written by":"Oluwapelumi Adejumo","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/#article","isPartOf":{"@id":"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/"},"author":{"@type":"Person","@id":"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/#person","name":"Oluwapelumi Adejumo","url":"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/","mainEntityOfPage":{"@id":"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/"},"image":{"@type":"ImageObject","@id":"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/#authorimage","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-oluwapelumi-adejumo-1-300x300.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-oluwapelumi-adejumo-1-300x300.jpg","caption":"Oluwapelumi Adejumo"},"jobTitle":"Senior Reporter","description":"Oluwapelumi values Bitcoin's potential. He imparts insights on a range of topics like DeFi, hacks, mining and culture, underlining transformative power.","worksFor":{"@id":"https:\/\/cryptoslate.com\/#organization"},"sameAs":["https:\/\/x.com\/hardeyjumoh","https:\/\/www.linkedin.com\/in\/oluwapelumi-adejumo","https:\/\/muckrack.com\/oluwapelumi-adejumo"]},"headline":"Coinbase traced $1.1 million crypto trail behind AI phishing service EvilTokens","datePublished":"2026-09-23T10:20:37+00:00","dateModified":"2026-09-23T10:20:37+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/"},"wordCount":721,"publisher":{"@id":"https:\/\/cryptoslate.com\/#organization"},"keywords":["AI","Coinbase","Microsoft","payments"],"articleSection":["AI","Crime","Payments"],"inLanguage":"en-US","copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/cryptoslate.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/","url":"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/","name":"Coinbase traced $1.1 million crypto trail behind AI phishing service EvilTokens","isPartOf":{"@id":"https:\/\/cryptoslate.com\/#website"},"datePublished":"2026-09-23T10:20:37+00:00","dateModified":"2026-09-23T10:20:37+00:00","description":"Microsoft and Coinbase helped dismantle EvilTokens after it compromised more than 12,000 email accounts across 10,000 organizations.","breadcrumb":{"@id":"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptoslate.com\/"},{"@type":"ListItem","position":2,"name":"Coinbase traced $1.1 million crypto trail behind AI phishing service EvilTokens"}]},{"@type":"WebSite","@id":"https:\/\/cryptoslate.com\/#website","url":"https:\/\/cryptoslate.com\/","name":"CryptoSlate","description":"Cryptocurrency News and Real-time Coin Data","publisher":{"@id":"https:\/\/cryptoslate.com\/#organization"},"inLanguage":"en-US"},{"@type":"NewsMediaOrganization","@id":"https:\/\/cryptoslate.com\/#organization","name":"CryptoSlate","url":"https:\/\/cryptoslate.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg","width":1000,"height":1000,"caption":"CryptoSlate"},"image":{"@id":"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/twitter.com\/cryptoslate","https:\/\/www.instagram.com\/cryptoslate","https:\/\/www.linkedin.com\/company\/cryptoslate","https:\/\/www.youtube.com\/c\/cryptoslate","https:\/\/t.me\/cryptoslatenews","https:\/\/www.crunchbase.com\/organization\/cryptoslate","https:\/\/iq.wiki\/wiki\/cryptoslate","https:\/\/news.google.com\/publications\/CAAqKggKIiRDQklTRlFnTWFoRUtEMk55ZVhCMGIzTnNZWFJsTG1OdmJTZ0FQAQ","https:\/\/muckrack.com\/media-outlet\/cryptoslate","https:\/\/www.tiktok.com\/@cryptoslatenews"],"publishingPrinciples":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles","ownershipFundingInfo":"https:\/\/cryptoslate.com\/disclaimers\/how-cryptoslate-makes-and-spends-money\/","correctionsPolicy":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback","ethicsPolicy":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles","foundingDate":"2017-08-04","founder":[{"@type":"Person","name":"Nate Whitehill"},{"@type":"Person","name":"Matthew Blancarte"}],"contactPoint":[{"@type":"ContactPoint","contactType":"customer support","url":"https:\/\/cryptoslate.com\/contact\/","availableLanguage":"en-US"},{"@type":"ContactPoint","contactType":"sales","url":"https:\/\/cryptoslate.com\/contact\/?topic=advertising#contact-form","availableLanguage":"en-US"},{"@type":"ContactPoint","contactType":"newsroom","url":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback","email":"tips@cryptoslate.com","availableLanguage":"en-US"}],"masthead":"https:\/\/cryptoslate.com\/about\/#masthead"},{"@type":"Person","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/b333928a322ba4c082e8bb2ad0f14eb6","name":"Oluwapelumi Adejumo","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/image\/","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-oluwapelumi-adejumo-1-150x150.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-oluwapelumi-adejumo-1-150x150.jpg","caption":"Oluwapelumi Adejumo"},"description":"Oluwapelumi values Bitcoin's potential. He imparts insights on a range of topics like DeFi, hacks, mining and culture, underlining transformative power.","jobTitle":"Reporter","worksFor":"CryptoSlate","url":"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/"}]}},"_links":{"self":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/565164"}],"collection":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/users\/720"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/comments?post=565164"}],"version-history":[{"count":4,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/565164\/revisions"}],"predecessor-version":[{"id":565213,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/565164\/revisions\/565213"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/media\/565195"}],"wp:attachment":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/media?parent=565164"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/categories?post=565164"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/tags?post=565164"},{"taxonomy":"prediction_market_topic","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/prediction_market_topic?post=565164"},{"taxonomy":"post_folder","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/post_folder?post=565164"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}