# Microsoft and Coinbase Takedown of EvilTokens Phishing Network

> Microsoft and Coinbase arrest two men behind AI-powered phishing network that stole $1.1m from businesses.
- Title: Microsoft and Coinbase Takedown of EvilTokens Phishing Network
- Summary: Microsoft and Coinbase arrest two men behind AI-powered phishing network that stole $1.1m from businesses. Microsoft and Coinbase arrested two men for…
- Keywords: microsoft, coinbase, eviltokens, phishing, telegram, tron blockchain, metropolitan police, okta, gmail, Takedown, Network, Fortune
- Source: Fortune — https://fortune.com/2026/09/22/microsoft-coinbase-phishing
- Author: Jeff John Roberts
- Read time: 1 min
- Topics: microsoft, coinbase, eviltokens, phishing, ai, telegram, tron blockchain, metropolitan police, okta, gmail
## Phishing Scam Overview
Phishing messages trick businesses into paying millions yearly with increasingly realistic fake emails from company CFOs or vendors.
## EvilTokens Takedown Announcement
Microsoft and Coinbase took down EvilTokens, a phishing network that defrauded real estate firms, banks, and healthcare providers.
## AI-Powered Phishing Kit
EvilTokens sold an AI-powered phishing kit on Telegram that mapped trusted relationships and identified payment targets for fraud.
## Phishing Campaign Mechanics
The kit bypassed two-factor authentication by directing victims to fake Microsoft or DocuSign pages with verification codes.
## Arrest Details
Two men aged 32 and 38 were arrested by the Metropolitan Police on September 11 for fraud and money laundering.
## Financial Impact
The perpetrators collected $1.1 million in cryptocurrency from over 700 distinct addresses between October 2025 and June 2026.
## Key takeaway

Microsoft and Coinbase arrested two men for running an AI phishing network that stole $1.1 million from businesses between October 2025 and June 2026.