Abnormal AI has released a comprehensive report detailing the ZeroTokens platform, a sophisticated live-operator phishing infrastructure that has evolved significantly since its initial disclosure in August 2026. The expanded investigation reveals the scope of operations, resilience, and technical sophistication, showing how threat actors have systematically targeted financial institutions globally. Since Abnormal's initial disclosure (below), the scope of the ZeroTokens campaign has expanded
