The seizure of 50 websites and more than 175 domains effectively ended the operations of EvilTokens, a Telegram-based cybercrime platform. An international coalition including Microsoft, Coinbase, Cloudflare, and OpenAI disrupted the AI-powered phishing network, which had compromised more than 12,000 email inboxes across 10,000 organizations. The tool exploited Microsoft’s legitimate device-code sign-in flow to automate victim harvesting and drafting of impersonation emails, leading to arrests of the network's operators by UK police on September 11.

Investigators and TRM Labs traced $1.1M in scam revenue to the Tron blockchain with support from the US District Court of the Eastern District of Virginia. Coinbase reported that no its own accounts were compromised during the attacks, though the company stated the operation illustrates how cybercriminals are now using AI agents to lower the barriers for large-scale business email compromise fraud.