Coinbase.com : EvilTokens was a turnkey phishing-as-a-service platform operated through Telegram bots. For a fee, anyone could run sophisticated BEC campaigns using its access weaponization, email harvesting, reconnaissance tooling, built-in webmail interface, and AI-powered automation. At the time of the takedown, its operator was signaling plans to expand the kit to target Gmail and Okta accounts.
What set EvilTokens apart wasn’t just its scale, it was how it used AI. Once inside a mailbox, the platform provided attackers with an AI-powered analyst that mapped trusted relationships, identified who controlled payments, and flagged where fraud was most likely to succeed. This collapsed a process that once required hours of manual inbox sifting into a near-instant automated targeting system, putting sophisticated fraud capabilities in the hands of far less skilled criminals. Investigators also found evidence that parts of the platform were « vibe coded, » meaning AI was used to build the criminal tools themselves, further lowering the barrier to entry for would-be fraudsters.
Consumer Protection Tuesday: Taking Down Evil Tokens
