Bottom line: EvilTokens uses AES-GCM encryption and device-code phishing to compromise Microsoft 365 accounts while evading traditional email filter detection.
A phishing wave named EvilTokens uses AES-GCM encryption to hide HTML content from traditional email filters. The attacks target Microsoft 365 accounts primarily and affect businesses in the United States and Europe.
The EvilTokens campaign employs an attack method known as ghost phishing: the HTML code of the phishing page is encrypted with AES-GCM. Static URL filters and network-based email security solutions therefore see only a harmless server response during the initial check. Decryption and loading of the actual phishing content into the Document Object Model (DOM) occurs only in the victim’s web browser, allowing the attack to evade traditional security checks.
The primary target is the compromise of Microsoft 365 accounts through so-called device-code phishing. Attackers guide victims through a legitimate-looking Microsoft sign-in process to grant account access – without needing to directly capture passwords. According to data from IT security firm ANY.RUN, certain industries are particularly heavily affected in 2026: consulting (75.6%), financial services (72.8%), manufacturing (71.9%), technology (67.9%), banking (66.7%), and Managed Security Service Providers (66.1%).
Security analyses in interactive sandbox environments demonstrate the campaign’s methodology. By analyzing browser behavior, it is possible to document how the hidden code appears in the DOM after decryption. Backend communication becomes visible as well, showing how the Microsoft device code is transmitted to the /api/device/start endpoint. On this basis, automated detection rules and behavioral indicators can be developed to block affected infrastructure and reduce response time in containing compromised accounts.
Source: www.it-daily.net · Published 10 July 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 of the EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.7.3.