A do-it-yourself phishing kit called EvilTokens, sold on Telegram for $100 to $300 a month, used a built-in AI analyst to map victims’ trusted relationships, identify who controlled payments, and flag where fraud was most likely to succeed after compromising Microsoft Outlook accounts and bypassing two-factor authentication. The kit compromised more than 700 distinct cryptocurrency wallet addresses across real estate firms, banks, and healthcare providers, netting roughly $1.1 million between October 2025 and June 2026. A coalition including Microsoft, Coinbase, Cloudflare, and OpenAI disrupted the network’s infrastructure, and London’s Metropolitan Police arrested two men in connection with the operation.