UK law enforcement officers arrested several individuals on September 11 and seized more than 175 domains in a coordinated crackdown on digital fraud. The target, a platform called EvilTokens, used artificial intelligence to automate phishing campaigns by identifying trusted contacts and drafting impersonation emails to hit more than 12,000 compromised inboxes across 10,000 organizations. A partnership between Microsoft, Coinbase, Cloudflare, OpenAI, and the US District Court of the Eastern District of Virginia dismantled the operation after tracing $1.1M in revenue on the Tron blockchain.

The service targeted business email compromise through automated tools on Telegram and abused Microsoft's device-code sign-in flow to gain access to victims. While Coinbase reported that no user accounts were compromised, security researchers have flagged separate ongoing criminal campaigns using an autonomous penetration-testing harness known as Cairn, highlighting a trend of attackers using AI agents to scale cyber operations.