EvilTokens Phishing Network Dismantled, Two Arrested

Microsoft and Coinbase dismantled EvilTokens, a Telegram phishing kit that used an AI analyst to bypass two-factor authentication. London's Metropolitan Police arrested two men on September 11. Microsoft seized 50 websites and disabled over 175 domains. Investigators traced about $1.1 million in crypto from over 700 addresses between October 2025 and June 2026. The kit sold for $100 to $300 monthly.