Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure

What it is

An active (as of March 2026) device code phishing campaign against Microsoft 365 identities, run through Railway.com PaaS IP infrastructure and attributed to the EvilTokens PhaaS platform. This document focuses on the operational takeaways an engineer needs, since the campaign's novelty is less the technique than the infrastructure choice and the remediation trap it creates.

How it works

The attack abuses the OAuth device authorization flow. A victim is lured into completing a legitimate-looking device code sign-in, which hands the attacker access and refresh tokens that remain valid even after a password reset. Auth originates from a narrow block of Railway.com IPs — a PaaS "built for vibe coding" that lets adversaries stand up and tear down internet-facing token-harvesting services at machine speed. Because Railway is a clean, rarely-blocked provider, this traffic evades Microsoft's risk scoring. Lures are AI-generated and individually tailored (Huntress observed no identical lures or initial domains), which defeats signature/duplicate-based email filtering.

Preconditions / Affected

• Microsoft 365 tenants that permit the OAuth device code flow.
• Organizations of any size/sector (law firms to construction) in the US, Canada, Australia, New Zealand, Germany. 340+ orgs, ~350 compromises, plus 113 further attempts blocked by March 23.

What to do

The page's own fetched text is truncated before its full mitigation list, but two actions are grounded in what it states:

• Do not rely on password resets to remediate. Stolen device-flow tokens survive a reset — revoke the affected sessions/tokens explicitly.
• Treat Railway.com IP space as suspect for M365 authentication. Huntress is blocking auth from Railway infrastructure to protected identities; most teams "have never had a reason to block" this provider, so it is likely unmonitored in your environment.
• Consider disabling the OAuth device code flow via Conditional Access if you have no legitimate use for it (implied by the technique, not a verbatim page instruction — verify before applying).

Caveats

• Huntress did not directly observe the actors using Railway's AI deployment features; they built a prototype to confirm the workflow is feasible even on the free tier. The "AI-accelerated infrastructure" angle is demonstrated capability, not observed TTP.
• Attribution to EvilTokens (first advertised on the NOIRLEGACY GROUP Telegram channel; first public post Feb 16, 2026) came in a March 23 update, in partnership with Flare.io.
• Open question the authors leave unresolved: whether this is one actor with a broad toolset (construction bids, DocuSign, voicemail, Microsoft Forms abuse all hitting the same victim pool via the same IPs) or multiple actors sharing the EvilTokens backend.