Microsoft and Coinbase probe leads to arrest of crooks behind ‘EvilTokens’, a DIY phishing network powered by AI

Microsoft and Coinbase dismantled the EvilTokens phishing-as-a-service network, which collected about $1.1 million in Tron-based cryptocurrency payments from more than 700 addresses between October 2025 and June 2026. The $100-$300 monthly toolkit used AI to map trusted relationships and identify payment controllers, enabling targeted business-email-compromise attacks that could bypass two-factor authentication. Civil actions seized 50 websites and disabled more than 175 domains, while UK police arrested two suspected operators; investigators said the group had been developing tools targeting Okta and Gmail.

Analysis

The investable read-through is less about direct loss avoidance and more about identity-stack vendor consolidation. MSFT can convert heightened executive concern around session-token theft and payment-workflow compromise into incremental E5 Security, Entra ID, Defender and Copilot-security attach; even modest seat expansion carries high incremental margins because distribution is embedded in the installed base. NET also benefits at the edge through phishing/domain protection and Zero Trust adoption, although the revenue effect is likely immaterial until management cites elevated demand or larger enterprise-security deal sizes.

OKTA faces a mixed setup: targeted attacker development against its ecosystem can raise demand for identity controls, but it also reinforces buyer preference for platform consolidation and increases the cost of proving resilience after prior trust incidents. That is more damaging to OKTA's sales-cycle duration and valuation multiple than to near-term revenue, particularly if CIOs standardize on Microsoft identity while rationalizing point products. DOCU has indirect downside risk as repeated impersonation campaigns make external recipients less willing to trust document-notification emails, raising customer-support and brand-protection costs rather than creating a material near-term revenue hit.

The contrarian point is that one infrastructure disruption rarely changes cyber budgets; adversaries can migrate domains, tooling and operators quickly. The 1-3 month catalyst is enterprise commentary on identity-security spending and seat attach in MSFT/NET results, not the enforcement action itself. Over 6-18 months, AI-assisted reconnaissance should shift security spend from endpoint-only tools toward identity, email security and transaction-verification workflows, but the thesis is falsified if phishing-related insurance claims and enterprise security spending remain stable through the next two reporting cycles.

Key Decisions for Investors

• Maintain or initiate a 3-6 month long MSFT / short OKTA pair, sized modestly: the trade expresses identity-platform consolidation rather than a broad cybersecurity-beta call. Reassess if OKTA reports accelerating net retention or materially shorter enterprise sales cycles, or if MSFT does not show security-suite attach or Azure/Entra security growth in its next two quarters.
• Add NET only on evidence of security-product traction—specifically accelerating large-customer growth, higher dollar-based net retention, or management commentary linking Zero Trust/email protection to bookings. Without those data, treat NET as a watch item rather than a direct beneficiary; its valuation leaves limited room for a purely narrative-driven rerating.
• Avoid treating COIN as a material earnings beneficiary. Improved security credibility may support institutional custody and platform trust at the margin, but transaction volumes, take rate and regulatory developments remain overwhelmingly more important; use any security-related strength to avoid chasing the stock absent crypto-market confirmation.
• Monitor DOCU enterprise renewal commentary and phishing/brand-abuse disclosures over the next 1-2 quarters. A measurable increase in customer friction or authentication-related support costs would support a tactical underweight versus MSFT; absent that evidence, the security linkage is too indirect for a standalone short.