Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure | Huntress

Keypoints

• Huntress attributed the Railway-hosted token-harvesting activity to the EvilTokens PhaaS platform, which publicly launched in February 2026 and offers Capture Link, B2B Sender, and SMTP Sender products with AI-assisted features.
• The primary attack technique was device code phishing that harvested OAuth tokens (including refresh tokens valid up to 90 days), enabling persistent access despite password resets or MFA.
• Most authentication abuse originated from a narrow set of Railway IPs (e.g., 162.220.234[.]41 and 162.220.234[.]66), with three IPs accounting for ~84% of observed events.
• Adversaries used multi-hop redirect chains and abused trusted services—email-security URL rewriters (Cisco, Trend Micro, Mimecast), compromised websites, vercel.app/amplifyapp hosts, and Cloudflare workers.dev—to launder links and bypass email filters.
• The campaign targeted 344 organizations across the US, Canada, Australia, New Zealand, and Germany, hitting diverse sectors (construction, law firms, manufacturing, finance, healthcare, government) and showing wide lure variety (RFPs, DocuSign, voicemail, Customer Voice forms).
• Huntress mitigations included blocking Railway CIDR blocks via Conditional Access Named Locations, pushing Conditional Access Policies to eligible tenants, and reporting workers.dev instances to Cloudflare for takedown.
• Detection and response recommendations emphasized hunting Railway IP logins, revoking affected users’ refresh tokens, enabling Continuous Access Evaluation (CAE), restricting device code flows, and targeted user training on device-code lures.