Wu said he learned that Coinbase stated that the phishing-as-a-service platform EvilTokens has been jointly taken down by multiple parties. The platform provides commercial email scam tools via a Telegram Bot. It uses the Microsoft Device Code login flow to诱导 victims into authorizing the attacker to access their email and bypass MFA. It then impersonates finance staff, vendors, or executives to intervene in real payment emails, tricking victims into transferring funds to accounts or crypto addresses controlled by the attackers. The platform also uses AI to analyze trust relationships in emails, payment permissions, and potential scam targets. Coinbase said its team traced approximately $1.1 million in platform revenue from October 2025 to June 2026, involving four Tron addresses, more than 1,000 deposits, and over 700 sending addresses. On September 11, the Metropolitan Police in the UK arrested the relevant operators. Microsoft froze 50 websites through civil litigation and disabled more than 175 related domains.