CoinMeta data: Wu said that Coinbase indicates that the phishing service platform eviltokens has been jointly targeted by multiple parties. This platform provides commercial email fraud tools through Telegram and bot, exploiting Microsoft's device and code login processes to trick victims into authorizing attackers to access their emails and bypass MFA. Subsequently, attackers impersonate financial personnel, suppliers, or executives to intervene in legitimate payment emails, inducing victims to transfer funds to accounts or encrypted addresses under their control. Coinbase stated that their team traced approximately $1.1 million in platform revenue from October 2025 to June 2026, involving 4 Tron addresses, over 1,000 deposits, and more than 700 sending addresses. The Metropolitan Police Department of the UK arrested the relevant operators on September 11th, and Microsoft seized 50 websites through civil litigation and disabled over 175 related domain names.