Coinbase (Organization): news timeline & CVEs

AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft

Microsoft disrupted EvilTokens, an AI-powered phishing platform that compromised 12,000+ email accounts across 10,000+ organizations.

Microsoft disrupted EvilTokens, an AI-powered phishing platform that compromised over 12,000 email accounts at more than 10,000 organizations. The platform used AI to automate device code phishing and account reconnaissance, requiring a $1,500 initial fee and $500 monthly subscription. Two suspects were arrested in the UK, and Microsoft seized 50 websites, with support from partners including SpyCloud, Coinbase, and OpenAI.

SecurityWeekSep 23, 11:23 UTC · 3d agoPhishing & fraud in the wild 14 sources1

EvilTokens made phishing-as-a-service look easy. Then it got taken down

Law enforcement takes down EvilTokens PhaaS kit that compromised 12,000 inboxes using AI-powered device-code phishing to bypass MFA.

Microsoft, Coinbase, and law enforcement have taken down EvilTokens, a phishing-as-a-service (PhaaS) kit operated by Storm-2992 that compromised over 12,000 inboxes across 10,000 organizations. The kit used device-code phishing to bypass MFA and AI-powered tools for post-compromise reconnaissance and payment fraud. Coinbase traced $1.1 million in cryptocurrency payments, leading to an arrest by London's Metropolitan Police. The takedown involved seizing 50 websites and disabling over 175 domains.

Security Affairsupdated Sep 23, 11:23 UTC · 3d agofirst Sep 23, 11:00 UTC · 3d agoPhishing & fraud in the wild 14 sources

Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes

Microsoft and partners seized EvilTokens infrastructure after the phishing service compromised over 12,000 inboxes.

Microsoft, with court authorization and partners including Health-ISAC, Cloudflare, Coinbase, and OpenAI, disrupted the EvilTokens phishing service, which compromised more than 12,000 inboxes at over 10,000 organizations. Victims entered an authentication code on Microsoft's legitimate sign-in page, granting persistent token access that could survive a password reset. The service's AI tools summarized and translated mail, identified payment contacts, and drafted impersonation messages. It sold on Telegram for a $1,500 fee plus $500 recurring. On September 11, 2026, London police arrested two men, and Microsoft seized 50 sites and disabled more than 150 domains.

Help Net Securityupdated Sep 23, 11:23 UTC · 3d agofirst Sep 23, 08:34 UTC · 3d agoPhishing & fraud in the wild 14 sources

Meta Takes Action on 3.7 Million Accounts, Pages and Content In Partnership With Singapore Police Force

Meta and Singapore police disrupted millions of scam accounts, pages, and prebuilt shell pages.

Meta said cooperation with the Singapore Police Force led it to act on about 3.7 million scam-linked accounts, pages, and content. From January to June 2026, SPF information drove action against more than 113,000 Facebook and Instagram entities, mostly investment scams, over five times the assets initially flagged. A June e-commerce operation covered more than 33,600 entities, and in July Meta removed over 3.6 million inactive shell pages. The work also aided 2025 arrests of seven men in a remote-betting case; a separate US-led disruption hit 1.4 million Meta assets and led Thai police to arrest 63 people. Meta reported removing 65 million scam ads this year, 94 percent before any user report.

Meta Newsroomupdated Sep 25, 15:41 UTC · 1d agofirst Sep 23, 01:01 UTC · 4d agoPhishing & fraud 2 sources

Microsoft’s EvilTokens takedown sheds light on state of AI-powered cybercrime

Microsoft seized EvilTokens infrastructure after the AI phishing service compromised about 12,000 Microsoft 365 inboxes.

Microsoft disrupted EvilTokens, an AI-powered phishing-as-a-service platform active since February 2026 and linked to more than 12,000 compromised Microsoft 365 inboxes at over 10,000 organizations. The service abused the OAuth 2.0 device-code flow so victims entered a code on Microsoft’s real login page and handed over session tokens without passwords, then used an AI chatbot to mine mailboxes for business-email-compromise opportunities. Pricing was a $1,500 signup and $500 per month. A US court order let Microsoft seize 50 websites and more than 150 domains, and UK police arrested two men, ages 32 and 38, who were later released on bail. Coinbase traced about $1.1 million across more than 700 crypto addresses.

CSO Onlineupdated Sep 23, 11:23 UTC · 3d agofirst Sep 22, 20:40 UTC · 4d agoPhishing & fraud in the wild 14 sources

Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises

Microsoft dismantled EvilTokens, an AI-assisted device-code phishing service linked to about 12,000 inbox takeovers.

Microsoft's Digital Crimes Unit, under an order from the U.S. District Court for the Eastern District of Virginia and with partners including Health-ISAC, Cloudflare, Coinbase, and OpenAI, dismantled EvilTokens, a phishing-as-a-service platform tied to about 12,000 inbox compromises. Microsoft tracks the operators as Storm-2992, and the Metropolitan Police Service arrested two men, ages 32 and 38, on September 11, 2026. The kit abused the OAuth 2.0 device-code flow so victims entered codes at Microsoft's real login page, giving attackers access and refresh tokens used for mailbox theft, hidden inbox rules, and business email compromise. Products sold for $600 to $1,500 plus a $500 monthly fee, and Coinbase traced about $1.1 million in Tron revenue from October 2025 to June 2026.

The Hacker Newsupdated Sep 23, 11:23 UTC · 3d agofirst Sep 22, 17:03 UTC · 4d agoPhishing & fraud in the wild 14 sources

Andreessen Horowitz is launching an ‘academy’ with no homework and partnerships with Palantir, Google, and Meta

Andreessen Horowitz launches a one-year San Francisco 'academy' with $42M funding and partners including OpenAI, Anthropic, and Palantir.

Venture firm Andreessen Horowitz (a16z) is creating the Horowitz Andreessen Academy, a free one-year program for 50 students starting fall 2027, aimed mainly at recent high-school graduates who must relocate to San Francisco. It launches with 10 partners — Anduril, Anthropic, Coinbase, Google, Meta, NVIDIA, OpenAI, Palantir, Replit, and Stripe — plus $42 million in funding led by a16z. Students receive over $50,000 in compute credits, a $5,000 travel/research budget, short classes from tech figures like Sam Altman, and company co-ops, with no grades, tests, or degrees.

The Verge · AISep 22, 16:34 UTC · 4d agoAI industry

UK Cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites

UK police arrested two EvilTokens admins as Microsoft seized sites used to phish over 12,000 inboxes.

Microsoft and partners disrupted EvilTokens, a device-code phishing kit sold as a service that compromised more than 12,000 email inboxes at over 10,000 organizations. The kit bypassed MFA to access Microsoft 365 and used an AI chatbot to analyze inboxes and select impersonation and fraud tactics. After a US court order, Microsoft seized 50 websites and disabled more than 150 related domains, with Health-ISAC as co-plaintiff. On September 18, London's Metropolitan Police arrested two alleged administrators, ages 32 and 38, who were later released on bail.

The Register · Securityupdated Sep 23, 11:23 UTC · 3d agofirst Sep 22, 15:00 UTC · 4d agoPhishing & fraud in the wild 14 sources

Microsoft and partners disrupt EvilTokens, a comprehensive cybercrime service for financial fraud

Court-ordered seizure of 50 EvilTokens websites disables an AI-driven PhaaS tied to 12,000 compromised Microsoft inboxes and $1.7M reported losses.

Acting on a federal court order dated September 15, Microsoft and partners seized 50 websites and disabled more than 175 domains supporting the EvilTokens phishing-as-a-service platform, which compromised over 12,000 Microsoft email inboxes across 10,000+ organizations since February 2026. About 1,000 cybercriminals used the service, which applied AI at every attack stage, from token theft to inbox analysis for BEC targeting. Microsoft correlated at least 13 FBI IC3 complaints representing roughly $1.7 million in losses, while Coinbase traced about $1.1 million in operator revenue from more than 1,000 deposits. UK Metropolitan Police arrested two suspected operators, aged 32 and 38, on September 18, both released on bail.

CyberScoopupdated Sep 23, 11:23 UTC · 3d agofirst Sep 22, 15:00 UTC · 4d agoPhishing & fraud in the wild 14 sources

Coinbase

Timeline9 articles

Appears with