EvilTokens hides its Microsoft 365 account-takeover flow behind AES-GCM browser-side decryption, creating a blind spot for static analysis and delaying SOC response. Browser-level inspection reveals the decrypted DOM, the /api/device/start request, and related device-code phishing infrastructure tied to broader activity in the United States and Europe. #EvilTokens #Microsoft365 #MicrosoftOAuth #CloudflareNet #ANYRUN
Keypoints
- EvilTokens is a phishing kit that conceals key parts of its landing page through browser-side AES-GCM decryption.
- The kit abuses Microsoft’s legitimate device login flow to gain access without directly stealing the victim’s password.
- Static URL and network-only checks can miss the decrypted content, leaving SOC teams with incomplete evidence.
- Browser-level inspection exposes the DOM changes, rendered content, and requests that generate the victim’s user code.
- ANY.RUN threat intelligence links one EvilTokens session to broader device-code phishing activity, related infrastructure, and similar kits.
- Recent EvilTokens activity is concentrated mainly in the United States and Europe and targets industries including managed security services, technology, manufacturing, education, banking, and consulting/financial services.
- Decrypted code and behavioral patterns can support better phishing signatures, threat hunting, and custom detection rules.
MITRE Techniques
- [T1056.001 ] Input Capture: Keylogging – The article describes the kit tricking the victim into entering or authorizing information through Microsoft’s device login flow rather than stealing a password directly, effectively capturing user action in the login process. [‘it convinces the victim to complete Microsoft’s legitimate device login flow and unknowingly authorize access to their account’]
- [T1566.002 ] Spearphishing Link – The attack uses a phishing landing page and link-based delivery to lure the victim into interacting with a malicious Microsoft device-code page. [‘The landing page HTML is encrypted with AES-GCM and becomes visible only after the browser decrypts it’]
- [T1110 ] Brute Force – Not directly used for password guessing, but the article indicates account takeover is achieved through authorization abuse rather than direct credential theft. [‘gain account access without directly stealing the victim’s password’]
- [T1528 ] Steal Application Access Token – The device-code phishing flow results in attackers retaining access authorized through the completed Microsoft device login flow, which functions like token-based account access. [‘the attackers retain the access authorized through the completed Microsoft device login flow’]
- [T1059.007 ] JavaScript – The page logic uses browser-side script to decrypt content, request the user code, and poll the session status. [‘The landing page HTML is encrypted with AES-GCM and becomes visible only after the browser decrypts it and renders it in the DOM’]
- [T1105 ] Ingress Tool Transfer – The browser retrieves the decrypted phishing content and user code from backend endpoints after page execution. [‘the landing page in an HTTP response encrypted with AES-GCM’ / ‘The next fragment sends a POST request to /api/device/start’]
Indicators of Compromise
- [Domains] infrastructure observed in the session – emp01825.workers.dev, and one other domain endpoint tied to the attack
- [URLs/URIs] device-code flow endpoints used by the kit – /api/device/start, /api/device/status/{sessionId}, and /api/device/gate/
- [File hashes] session artifact used for pivoting – fcd1b654a0b3e8f85ca7cfdafe494d4b
- [Threat names / signatures] TI pivots and detection labels – EvilTokens, Microsoft OAuth device-code phishing has been detected, oauth-ms-phish
- [IP addresses / network context] shared hosting and infrastructure context – CloudflareNet IP address, plus ASN information referenced in Indicators
- [TLDs / subdomains] indicator sets collected from browser data – top-level domains and subdomains associated with the phishing page, along with URL endpoints
Read more: https://any.run/cybersecurity-blog/eviltokens-ghost-code-analysis/