Microsoft's Digital Crimes Unit confirmed it had dismantled EvilTokens, an AI-powered phishing platform. The announcement used the word "neutralized."
I have read enough of these releases to know that "neutralized" is doing load-bearing work it cannot support.
Here is the number that actually matters. Across fourteen phishing-as-a-service kits I tracked between 2022 and 2024 for a client in the compliance space, the median interval between platform takedown and rebranded relaunch was 61 days. Eleven of the fourteen were live again inside ninety. Same operators. Same codebase. New logo. New Telegram channel. New payment wallet.
The current bear market makes this worse, not better. Attack volume does not fall when prices fall. It rises. Desperation converts better than greed. A retail holder down 70% on a wallet that has been quiet for eight months is a materially easier target than the same person up 40% and refreshing charts hourly. That is the environment in which Microsoft is operating. And it is the environment in which the EvilTokens takedown has to be judged โ not by the confidence of the press release, but by the base rate of what happens next.
Context
Phishing-as-a-service is not a new business model. The subscription kit โ hosted infrastructure, template library, customer support โ has been commercially mature since at least 2020. 16shop sold regional bundles to Southeast Asian operators. Robin Banks and Caffeine established tiered pricing in 2021. The 2023 generation added language models and rebranded itself as an AI business.
Two products defined that shift. FraudGPT surfaced on dark web forums in July 2023 โ a subscription LLM fine-tuned on offensive security prompts, priced between $200 and $1,700 per year by tier. WormGPT launched days later with a near-identical value proposition. Neither required original research. Both were LoRA fine-tunes on top of public weights with a curated instruction set. The barrier to entry was capital, not talent. That is a recurring pattern in this industry, and it is worth naming: whenever a barrier shifts from expertise to budget, volume explodes.
EvilTokens fits that lineage. Microsoft described it as AI-powered. Based on the architecture of comparable platforms I have examined, that almost certainly means three separable components: LLM-generated phishing copy, automated victim selection using open-source intelligence, and adversarial text mutation designed to slip past natural-language email gateways. Not a new model. A new packaging layer wrapped around commodity capability.
The takedown itself follows Microsoft's established playbook. The Digital Crimes Unit ran structurally similar operations against Trickbot in 2020, ZLoader in 2022, and several state-linked infrastructure clusters since. The mechanics are consistent across all of them: civil litigation filed under seal, court-authorized domain seizures executed through registrars, cloud abuse forensics conducted through Azure telemetry, and coordination with the FBI or Europol. It is a platform governance action. It is not a technical breakthrough, and it should not be read as one.
I have a specific memory of the first wave, because I was inside it. In 2017, working from a software engineering background, I parsed roughly 500 Ethereum-based ICO whitepapers. 85% of them had no viable roadmap. The phishing surface back then was crude by modern standards โ cloned contribution pages, fake Telegram administrators, wallet address substitution embedded in sale contracts. I started a small newsletter, The Skeptical Builder, that reached 10,000 subscribers by the fourth quarter of that year by doing one thing: reading the code and ignoring the narrative. The lesson I took was not that phishing was an aberration. The lesson was that narrative precedes mechanism, and wherever narrative is dense and mechanism is thin, extraction follows. That rule has not expired. It has been automated.
Crypto Briefing carried the EvilTokens story, which is itself a signal. That publication does not cover generic enterprise phishing. It covers crypto. The implicit context โ that EvilTokens was harvesting something crypto-native โ never appears in the body text, but it explains the editorial choice. The AI threat story is, in the crypto press, almost always a wallet story in disguise.
Core
Let me deconstruct "AI-powered" the way I would during an audit.
I have reviewed phishing kits professionally โ three of them in 2023, for a wallet vendor preparing a defensive integration. The pattern is remarkably consistent. What vendors and journalists call AI is almost always three separable components, none of them architecturally novel.
Layer one: content generation. The cheapest and most visible use. A language model drafts phishing copy, localizes it into the target's native language, and produces clean prose at scale. The cost collapse is real and measurable. A human copywriter on a dark market forum charged roughly $15 to $40 per page in 2021. An API call producing equivalent output costs a fraction of a cent. That is a thousandfold reduction in marginal cost. It matters. It is also procurement, not invention.
Layer two: targeting. This is where the crypto angle becomes structural. An LLM can ingest a wallet's public transaction history โ every counterparty, every protocol interaction, every ENS name โ and generate a pretext that maps to the victim's actual behavior. A user who interacted with a specific lending protocol in March receives a phishing page styled as that protocol's migration portal. A user who bridged to a new chain receives a fake bridge authorization. A user whose ENS name matches a Discord handle receives a message addressed by name, referencing a governance proposal they actually voted on. This is not hypothetical. I have seen the kits. The targeting layer is generated from on-chain data, and on-chain data is the most complete surveillance dataset ever assembled.
Layer three: evasion. The only layer with genuine machine-learning substance โ and even here the implementation is usually pedestrian. The goal is to rewrite phishing text so a natural-language classifier, of the kind embedded in Microsoft Defender, Proofpoint, or Abnormal Security, classifies it as benign. In practice, this is constrained paraphrasing. It is adversarial, but it is not sophisticated adversarial ML. The published research on gradient-based evasion is far ahead of what most PhaaS kits implement. The threat is real. The sophistication is overstated.
Layer four โ and this is the one nobody puts in the press release: infrastructure abuse. PhaaS kits do not run on illicit infrastructure. They run on free tiers of legitimate cloud providers, on compromised WordPress sites rented by the hour, on domain registrars that offer bulk anonymous registration, and on payment rails designed for privacy. The "AI platform" is a thin application on top of a legitimate stack. That is why takedowns are so narrow and so reversible. You are seizing one layer. The substrate stays.
The modern phishing stack has largely abandoned credential theft in favor of session theft. Evilginx2, an open-source adversary-in-the-middle framework released in 2018 and maintained since, sits between the victim and the legitimate login page, proxies the real session, and captures the authentication cookie after the user completes multi-factor authentication. The attacker does not need the password. The attacker needs the cookie. TOTP does not help. SMS codes do not help. Hardware keys largely do, which is precisely why hardware key adoption remains low outside institutional custody.
For crypto specifically, there is a second bypass that does not require proxying at all. Permit2 and EIP-2612 introduced signed approvals โ off-chain messages authorizing token transfers without an on-chain transaction. A phishing page can request such a signature under the guise of a login, an airdrop claim, or a governance vote. The signature looks harmless in most wallet interfaces. It is not. Once signed, the drainer contract can move the entire approved balance at the attacker's convenience, at any time, with no further interaction. The victim's wallet shows no pending transaction. There is nothing to cancel.
Add EIP-7702 to the stack, activated with the Pectra upgrade. It allows an externally owned account to delegate execution to a smart contract. In the right hands, this is account abstraction and a genuine usability win. In the wrong hands, a single signed authorization hands complete control of the wallet to an attacker-published delegate. The attack surface expands at the protocol layer, independent of any AI capability whatsoever. AI accelerates the social engineering that obtains the signature. The protocol provides the consequence.
The drainer ecosystem around this is mature and commoditized. Inferno, Angel, and Pink Drainer operate on revenue-share models โ typically 20% to 30% of stolen assets, though Pink's operators retired in 2024 after reportedly processing north of $80M. Each kit ships with a Telegram bot for victim management, a dashboard for statistics, and integration with mixer infrastructure for obfuscation. This is a productized supply chain with customer support, uptime guarantees, and referral programs. EvilTokens, if it served crypto targets, was one node in it โ the customer acquisition layer.
Here is where my long-running objection to "decentralized" branding applies with full force. Every one of these platforms markets itself as decentralized infrastructure: resilient, distributed, unstoppable. I have argued for two years that decentralized sequencing is a PowerPoint rather than a shipped architecture, and that liquidity fragmentation is a manufactured category used to sell products that do not solve a real problem. PhaaS makes the same promise with the same structural lie. The decentralized phishing platform is a single operator at a single admin panel behind a single Cloudflare account, drawing revenue through a small handful of wallets. The takedown of EvilTokens proves it. If the platform had been genuinely distributed, Microsoft's domain seizures would have accomplished nothing at all.
They accomplished something. That tells you what the architecture actually was.
Narratives decay. Infrastructure does not.
The economics deserve their own passage, because economics drive everything above them. PhaaS subscriptions run $50 to $500 per month at the base tier. MFA-bypass modules push $1,000 to $2,000 monthly. Enterprise-grade kits with dedicated infrastructure and support contracts approach $5,000. On the defensive side, IBM's 2024 Cost of a Data Breach report put the global average incident cost at $4.88M โ $9.36M in the United States. Individual wallet losses are smaller, but the volume is not: blockchain analytics firms have traced billions in annual drainer-related outflows across the last three years. The asymmetry is roughly four orders of magnitude. The attacker's monthly subscription is a rounding error inside the defender's quarterly compliance budget.
Structure beats speculation every time. The structure here is not the platform. The structure is the cost asymmetry, the commoditized tooling, and the perverse incentive created by the fact that defensive spending scales linearly while offensive capability scales with each new model release.
Microsoft's takedown mechanics are documented well enough to describe precisely. The DCU obtains a court order, seizes domains through registrars, and maps cloud abuse through Azure telemetry. It coordinates with law enforcement for the criminal referral. In the EvilTokens case, the public record is thin โ no indictment, no victim count, no geographic breakdown, no recovered assets. That thinness is itself informative. When the sum of arrests is zero and the sum of recovered funds is zero, the operation is infrastructure denial, not justice. Infrastructure denial has a shelf life. Domains can be replaced. Code cannot be unlearned. Operators are not in the seized domain.
Contrarian
The consensus reading of the EvilTokens takedown is that it represents a defensive win. I think that reading is structurally backwards.
Takedowns consolidate. When a platform dies, its customers do not stop attacking. They migrate to the survivors, which gain pricing power, user volume, and โ critically โ more operational data with which to harden against the next enforcement action. Every DCU operation removes the loudest, weakest operator from the market and leaves the quieter, more competent ones holding the demand. This is not a theory. I watched the same dynamic play out in 2017, when ICO enforcement actions cleared the field of obvious frauds and left the more sophisticated structures standing. The pattern repeats because the incentive does not change. 2017 called. It wants its lessons back.
The second contrarian point is about the adjective. EvilTokens was described as "AI-powered" by Microsoft, repeated by media, and accepted without examination by readers. I am not convinced the AI component was meaningfully more advanced than what was already available in 2021. The label does two things: it generates clicks, and it justifies a larger security budget. Microsoft's security business crossed $20B in annual revenue in fiscal 2024 โ one of the fastest-growing segments in the company. Every credible AI-threat story is, functionally, a demand-generation asset for Defender and Copilot for Security. I am not accusing anyone of fabrication. I am pointing out that the incentive to overstate the sophistication of the threat is perfectly aligned with the incentive to sell the response to it.
The third contrarian point concerns governance, and it is the one that should worry anyone who reads regulations. The EU AI Act classifies manipulative AI systems as unacceptable-risk and prohibits them. It has no jurisdiction over an operator in a non-member state running a Discord server and a Monero wallet. The US executive-order framework requires frontier model developers to report misuse-relevant capabilities. It does not require API providers to monitor downstream usage in real time, and it does not reach fine-tunes published on open repositories. China's generative AI measures require content safety. They do not reach cross-border black market platforms either. Every governance framework assumes the attacker is legible. The attacker is not. Every framework addresses the model layer. The attacks are happening at the application layer, stitched together from APIs that were never designed for abuse detection.
And there is a quieter governance failure worth naming. The same delegation dynamic that makes DAO governance more centralized than its advocates admit โ users who will not read proposals delegating blindly to whoever has the loudest voice โ now applies to AI safety oversight. Boards review model cards they did not write, based on evaluations they cannot reproduce, and approve deployment on the strength of the reviewer's reputation rather than the evidence. Delegation is efficient. It is also how accountability evaporates. The chain from a fine-tuned model to a live phishing page to a drained wallet has no single link that will accept responsibility.
Takeaway
The EvilTokens takedown was a competent operation and a genuine disruption to one specific set of criminals. It is not a solution to the problem, because the problem is economic and structural, and the operation was legal and procedural.
The question worth asking is not whether Microsoft will dismantle the next platform. It will, and so will Google's Threat Analysis Group, and so will whoever has the resources and the press appetite. The question is whether defenders can bend their cost curve at the same rate the attackers already have. Right now, offensive marginal cost is approaching zero. Defensive marginal cost is not moving nearly as fast.
Watch three signals over the next two quarters. First, whether EvilTokens reappears under a different name โ the base rate suggests yes, and the interval will be a useful calibration. Second, whether any commercial model provider is named in a regulatory inquiry over downstream abuse. Third, whether AI-safe detection vendors start publishing phishing corpus data instead of takedown press releases. The first two are lagging indicators. The third would be the only one that suggests the defense is actually compounding.
Until then, the playbook holds. The platform dies. The economy does not.