Microsoft, Coinbase, and law enforcement agencies have dismantled the EvilTokens phishing-as-a-service platform. The operation, authorized by a US District Court order, resulted in the seizure of 50 websites and the disabling of over 150 domains associated with the service.
Launched in February 2026, EvilTokens provided cybercriminals with tools for device-code attacks that bypass multi-factor authentication. The platform included an AI chatbot for analyzing compromised inboxes and planning further fraud. Microsoft tracks the group behind the service as Storm-2992.
The platform compromised over 12,000 email accounts across more than 10,000 organizations in 79 countries. Approximately 1,000 cybercriminals used the service, which charged a $1,500 setup fee and a monthly subscription of $500.
Coinbase analysts traced $1.1 million in illicit revenue linked to the operation across four Tron addresses and more than 700 deposit addresses. On September 11, 2026, London police arrested two suspects, aged 32 and 38, who were later released on bail.
