Device Code Phishing Campaign
9e53ddf71e92d998-AKL confirms this infrastructure is actively serving phishing pages from Cloudflare's Auckland (AKL) edge node, directly targeting New Zealand organisations. This constitutes a national-scale incident warranting immediate CERT NZ notification.
EvilTokens is a newly emerged Phishing-as-a-Service (PhaaS) platform first identified in cybercrime communities in early March 2026. It delivers a turnkey Microsoft device code phishing kit to cybercriminals and is assessed as the first PhaaS to offer ready-made Microsoft device code phishing pages combined with full post-compromise tooling — a capability that sets it apart from every existing AiTM-based PhaaS platform.
Unlike traditional phishing that spoofs login pages, EvilTokens exploits the OAuth 2.0 Device Authorization Grant — a legitimate Microsoft flow designed for input-limited devices. The victim authenticates on the real Microsoft website. There is no fake login page. MFA is bypassed by design. Standard security awareness training about "fake websites" provides zero protection.
Once tokens are harvested, the attacker escalates to a Primary Refresh Token (PRT), registering a new device in Entra ID. This grants full silent access to all Microsoft 365 applications — Outlook, SharePoint, Teams, Azure — bypassing MFA entirely and establishing persistent access for up to 90 days.
This report documents a live reverse engineering investigation conducted on 1 April 2026. Using passive extraction techniques and legitimate TI research methods, the team retrieved and analysed a live EvilTokens phishing page, mapped the backend API infrastructure, and discovered a fully unauthenticated /health endpoint that exposed the live victim count (2,795 active sessions), server metrics, and a 73.2% success rate — confirming this is an operational, production-grade attack platform actively targeting NZ.
| Attribute | Detail |
|---|---|
| Operator Handle | eviltokensadmin |
| Platform Type | Phishing-as-a-Service (PhaaS) — affiliate model |
| First Seen | Early March 2026 (cybercrime communities) |
| Affiliate Mgmt | Fully featured Telegram bot panel |
| Backend Dev | AI-generated ("vibe coded") JavaScript — assessed entirely via LLM |
| Known Targets | Finance, HR, Logistics, Sales departments — Americas, Europe, Middle East, Asia, Oceania (incl. AU/NZ) |
| Planned Expansion | Gmail and Okta phishing pages announced |
| Infrastructure | Cloudflare Workers + Railway.com PaaS + AWS S3 |
| Delivery Method | PDF, HTML, XLSX, SVG, DOCX attachments — QR codes and hyperlinks |
The EvilTokens operator runs a fully automated token persistence engine via the BAV2ROPC user agent, firing twice daily (11:00 AM and 8:00 PM operator timezone) to silently refresh all harvested tokens. Once a victim is compromised, the attacker's access is maintained automatically without any further human interaction.
The entire backend JavaScript codebase is assessed to have been AI-generated. The PhaaS also integrates AI-powered automation for BEC fraud execution — using harvested access to draft and send fraudulent business emails, request wire transfers, and harvest financial credentials at scale without manual operator involvement.
document.write() — the URL bar continues to show the S3 address throughout the entire attack.FM624XDF7). All CSS class names are obfuscated (_uo30jc, _nihz1a) to defeat CSS-based detection. The Adobe logo is rendered as raw SVG polygons — not an image — defeating image hash detection.microsoft.com/devicelogin popup. The victim enters the device code and authenticates normally using their real credentials and MFA. They believe they are securely signing a document. The attacker's device is silently granted full OAuth access. The victim sees "Access granted. You may close this window."/api/status/[SID]. When the victim completes authentication, the session transitions from "pending" to "captured". The backend stores the access_token (60-minute window) and refresh_token (90-day rolling) in a SQLite database. Affiliate is notified via Telegram bot.The phishing lure page is hosted as a Cloudflare Worker behind the custom domain auth.loadingdocuments.uk. Confirmed by Server-Timing: cfWorker;dur=730 with cfOrigin=0 (no external backend for page serving). This means the lure page has zero infrastructure origin — it runs entirely within Cloudflare's edge network, making it impossible to take down via origin server disruption.
The token management API runs at api.loadingdocuments.uk:8443 on a 4-core server with no authentication on multiple endpoints. The /health endpoint is fully open, exposing live victim counts and server metrics. The /api/generate and /api/status/[SID] endpoints require zero credentials. The server uses SQLite with WAL mode and runs 21 worker threads.
Post-compromise automation runs from Railway.com infrastructure. Three IPs account for 84% of all token replay events. Railway is specifically chosen because its IP ranges (162.220.232.0/22, 162.220.234.0/22) carry no risk score in Microsoft Identity Protection — sign-ins from these IPs are flagged as normal.
All Cloudflare Workers domains follow a deterministic schema based on lure type and affiliate's Microsoft email. Victim-personalised variants embed the target email address (dots/@ replaced by dashes) in the subdomain for tracking.
| Lure Type | Domain Pattern |
|---|---|
| Adobe Acrobat | adobe-[a-z0-9]{3}.[a-z0-9-]{3,}-s-account.workers.dev |
| DocuSign | docusign-[a-z0-9]{3}.[a-z0-9-]{3,}-s-account.workers.dev |
| Quarantine Alert | quarantine-[a-z0-9]{3}.[a-z0-9-]{3,}-s-account.workers.dev |
| Voicemail | voicemail-[a-z0-9]{3}.[a-z0-9-]{3,}-s-account.workers.dev |
| SharePoint | sharepoint-[a-z0-9]{3}.[a-z0-9-]{3,}-s-account.workers.dev |
| OneDrive | onedrive-[a-z0-9]{3}.[a-z0-9-]{3,}-s-account.workers.dev |
| Password Expiry | page-password-[a-z0-9]{3}.[a-z0-9-]{3,}-s-account.workers.dev |
| Railway IP | Event Count | Role |
|---|---|---|
162.220.234.41 | 254 events | Primary token attack engine |
162.220.234.66 | 132 events | Secondary engine |
162.220.232.57 | 97 events | Third-highest volume |
162.220.232.99 | 38 events | SAML token replay |
162.220.232.235 | 15 events | SAML + OAuth mixed |
iPhone OS 18_7 + Safari Version/26.3. iOS 26 does not exist. This combination, originating from Railway.com IP ranges, has near-zero false positives and can be used as a production detection rule in Microsoft Sentinel.https://49-qwer-hyper-552df-raven-931-5p.s3.us-east-1.amazonaws.com/ 59406576-3EDFGFHJH-43423F0KGTR65-768JER-RF-HUEDS-RET657/ing.html
