How Social Engineering Exploits Trusted Identities, Platforms, and Workflows
Summary
The article explains how attackers exploit trusted tools and workflows, including an EvilTokens campaign that used Microsoft device-code phishing to target 340+ organizations, and urges teams to prioritize identity behavior, clear ownership, and rapid response.
Key points
- The EvilTokens phishing-as-a-service campaign abused Railway and legitimate Microsoft OAuth device-code flows to target more than 340 organizations.
- Victims were tricked into authenticating attackers’ sessions, granting persistent tokens for services including email, Teams, SharePoint, and OneDrive; the article says password resets did not invalidate the tokens.
- The article describes malicious search results and fake AI support instructions that led users to download malware or execute commands installing the AMOS infostealer.
- It argues that deepfakes and abuse of trusted workflows make identity and behavior signals more useful than relying solely on familiar-looking domains or lures.
- The article cites survey findings that identity-based attacks are organizations’ least-prepared area (26.5%) and that 32% lack ITDR.
- Recommended resilience priorities include reducing alert noise, assigning response ownership in advance, monitoring identity and session behavior, and speeding up action on meaningful signals.
Article Details
- Topic
- Social engineering and device code phishing using trusted platforms, and the need for identity-focused security resilience
MITRE ATT&CK
People
Anna PhamHuntress Senior Tactical Response Analyst quoted on how alert overload and unclear ownership slow response.Eric StrideHuntress Chief Security Officer quoted on security resilience and acting quickly on meaningful signals.Gavin HillHuntress Vice President of Product Marketing quoted on breach mitigation and correlating identity, endpoint, and user behavior.
Malware
Vendors
CloudflareThe attack chain ran through legitimate Railway-hosted infrastructure, Cloudflare Workers pages, compromised websites, and trusted URL redirectors at machine speed.Microsoftsecurity controls: they're operating inside them. Deepfakes, poisoned AI platforms, and hijacked Microsoft authentication flows have turned identity, everyday workflows, and the tools teams rely on into the lureRailway2. Legitimate infrastructure is the new cover. The Railway/EvilTokens campaign used a real cloud platform, real Microsoft auth flows, and AI-generated lures to hit 340+ organizations with no two identical phishing
Products
Cloudflare WorkersThe attack chain ran through legitimate Railway-hosted infrastructure, Cloudflare Workers pages, compromised websites, and trusted URL redirectors at machine speed.Microsoft 365 Apps for EnterpriseOur platform combines a suite of powerful managed detection and response tools for endpoints and Microsoft 365 identities, science-backed security awareness training, and the expertise of our 24/7 Security OperationsMicrosoft OneDriveThe token granted access to email, Teams, SharePoint, and OneDrive and stayed valid even after a password reset.Microsoft SharePointThe token granted access to email, Teams, SharePoint, and OneDrive and stayed valid even after a password reset.Railway2. Legitimate infrastructure is the new cover. The Railway/EvilTokens campaign used a real cloud platform, real Microsoft auth flows, and AI-generated lures to hit 340+ organizations with no two identical phishing
Countries
AustraliaMore than 340 organizations across the US, Canada, Australia, New Zealand, and Germany were hit.CanadaMore than 340 organizations across the US, Canada, Australia, New Zealand, and Germany were hit.GermanyMore than 340 organizations across the US, Canada, Australia, New Zealand, and Germany were hit.New ZealandMore than 340 organizations across the US, Canada, Australia, New Zealand, and Germany were hit.United StatesThey’re running social engineering scams inside them, using the same tools, workflows, and signals against us that we’re supposed to trust.