🕵️ EvilTokens

The items that name it 14

• Unboxing Phishing Kits: Huntress Examines 3 Real Kits
  articleas classification.key entities2026-10-22
• Passkeys Raise the Bar. Here’s Where Attackers Can Still Get In.
  articleas classification.key entities2026-10-14
• Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses
  articleas threat actors2026-10-01

  Used device code phishing pattern leaning on legitimate infrastructure and AI-tuned lures; hit 344 organizations across five countries in a 16-day window

• Inside Knight Office, a New M365 AiTM Phishing Kit
  writeupas threat actors2026-09-02

  Another AiTM phishing kit referenced by Huntress as similar to Knight Office, targeting valid session tokens to bypass MFA

• Next-Gen Phishing Tactics Users Aren’t Ready For | Huntress
  articleas threat actors2026-08-28

  Phishing-as-a-service (PhaaS) offering that has built device code phishing into its capabilities

• Device Code Phishing Keeps Evolving. Here’s What to Watch For
  writeupas threat actors2026-07-31

  Phishing-as-a-service (PhaaS) platform attributed to an earlier wave of device code phishing attacks that stemmed from Railway, a platform-as-a-service used for vibe coding; that activity has since tapered off.

• What Are Initial Access Brokers?
  articleas threat actors2026-07-21

  Phishing campaign/lure using a proposal-and-bid-documents pretext, referenced as an example of IAB phishing tradecraft (Figure 3).

• Conditional Access Misconfigurations Exposed 55 Orgs with MFA On
  articleas threat actors2026-07-09

  Commercial PhaaS platform attributed as the source of the Railway device code phishing campaign; has a storefront, AI-assisted lure generation, 24/7 support team, and customer reviews. Tracked by Huntress in partnership with Flare.io.

• We Need to Talk About Device Code Phishing
  articleas threat actors2026-06-22

  Phishing-as-a-service (PhaaS) kit; in March 2026 caused a surge in device code phishing attacks. Attributed as the source of a large-scale device code phishing campaign starting March 2, 2026 targeting 344 organizations across the US, Canada, Australia, New Zealand, and Germany, abusing Railway.com

• Inside Kali365, a Device Code Phishing Ecosystem | Huntress
  writeupas threat actors2026-06-11

  Prior PhaaS campaign reported by Huntress earlier in 2026 (referenced as similar to Kali365 in using device authentication code flow); impact previously discussed in a Huntress report from February 2026.

• How EvilTokens Turbocharges Old School Phishing with AI
  articleas threat actors2026-05-11

  Device code phishing-as-a-service platform sold on Telegram for ~$1,500 plus a $500 maintenance fee; used AI to generate personalized lures, dynamically generate device codes, and craft follow-on wire fraud emails in the victim's voice. Campaign detected via alerts starting February 19, small blips

• Social Engineering Leveled Up. Has Your Security Program?
  articleas threat actors2026-05-01

  A productized phishing-as-a-service (PHaaS) operation that weaponized Railway to stand up credential-harvesting infrastructure on demand; ran the 'Railway campaign' hitting more than 340 organizations across the US, Canada, Australia, New Zealand, and Germany

• Attackers Didn’t Wait for AI. They Built Workflows Around It.
  articleas threat actors2026-04-22

  Productized cybercrime operation/phishing platform selling reusable session token theft infrastructure and phishing lure generation, including B2B Sender and Capture Link products with integrated AI tooling

• Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure
  writeupas threat actors2026-03-23

  Phishing as a Service (PhaaS) platform attributed by Huntress (in partnership with Flare.io and community contacts) as responsible for the Railway.com M365 token replay campaign; first advertised on the NOIRLEGACY GROUP Telegram channel, made first public post February 16th 2026; offers 'B2B Sender'