The service targeted business email compromise through automated tools on Telegram and abused Microsoft's device-code sign-in flow to gain access to victims. While Coinbase reported that no user accounts were compromised, security researchers have flagged separate ongoing criminal campaigns using an autonomous penetration-testing harness known as Cairn, highlighting a trend of attackers using AI agents to scale cyber operations.
Wednesday, October 21, 2026
Story
Microsoft and Coinbase Dismantle AI Phishing Network of 12000 Victims
Cybersecurity28 days ago
UK law enforcement officers arrested several individuals on September 11 and seized more than 175 domains in a coordinated crackdown on digital fraud. The target, a platform called EvilTokens, used artificial intelligence to automate phishing campaigns by identifying trusted contacts and drafting impersonation emails to hit more than 12,000 compromised inboxes across 10,000 organizations. A partnership between Microsoft, Coinbase, Cloudflare, OpenAI, and the US District Court of the Eastern District of Virginia dismantled the operation after tracing $1.1M in revenue on the Tron blockchain.
Looking for more context or analysis?
Tilt chat provides reliable, tailored insights, alerts, and automations.