Huntress Links Microsoft 365 Device-Code Phishing Campaign to EvilTokens
Summary
Huntress says an EvilTokens campaign used Railway-hosted infrastructure for Microsoft 365 device-code phishing, affecting 344 organizations. The investigation details token replay and phishing methods; Huntress reports blocking further attempts.
Key points
- Huntress and Flare attributed the campaign to the EvilTokens phishing-as-a-service platform; Huntress says it first observed compromises on February 19, 2026.
- The campaign targeted Microsoft 365 identities at 344 organizations across the US, Canada, Australia, New Zealand, and Germany, with device-code phishing identified in 87.4% of cases.
- Attackers used Railway infrastructure to harvest and replay OAuth tokens. Huntress says three Railway IPs accounted for about 84% of observed authentication events.
- Phishing delivery included personalized lures, multi-hop redirects, email security vendor URL rewriters, compromised websites, and Cloudflare Workers-hosted pages.
- Huntress reports that EvilTokens offers phishing products with AI-assisted lure and email-filter evasion features; it did not directly observe attackers using Railway’s AI features.
- Huntress blocked Railway-originated logins for eligible tenants and says it had blocked 113 attempted compromises by March 23, in addition to about 350 reported over the prior two weeks.
- Recommended responses include investigating sign-ins from Railway IP ranges, revoking affected users’ refresh tokens, restricting device-code authentication, and enabling Continuous Access Evaluation.
Article Details
- Attack Vectors
- Device-code phishing tricked Microsoft 365 users into entering attacker-generated codes at the legitimate Microsoft device authorization endpoint, yielding OAuth access and refresh tokens.
- Phishing lures used personalized construction bid, document-sharing, voicemail, and other pretexts, with links wrapped in legitimate email-security URL rewriters and multi-hop redirects.
- Phishing pages and redirect hops were hosted on Cloudflare workers.dev, Railway, third-party platforms, and compromised organization websites.
- The attackers replayed harvested tokens from Railway infrastructure; BAV2ROPC user-agent events were associated with automated refresh-token exchanges.
- Huntress attributed the campaign to the EvilTokens Phishing as a Service platform, whose advertised features include phishing-lure customization and credential capture.
- Defensive Notes
- Hunt for successful sign-ins from the listed Railway IPs; the article says any successful authentication from this infrastructure is a confirmed compromise.
- Revoke affected users’ refresh tokens. The article cautions that in-flight OAuth access tokens may remain valid for about an hour unless Continuous Access Evaluation is enabled.
- Consider blocking Railway IP ranges with Conditional Access Named Locations where no legitimate Railway-deployed applications are used.
- Restrict device-code authentication flows to identities that require them, and require compliant devices for Exchange Online and SharePoint.
- Enable Continuous Access Evaluation to reduce token-revocation latency, and train users not to trust device-code prompts solely because they appear on the legitimate Microsoft authentication endpoint.
- Monitor for Railway sign-ins using BAV2ROPC and for iPhone user-agent strings pairing iOS 18 with Version/26.x from cloud-provider IP ranges.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | app[.]usewhale[.]io | Third-party document-creation site identified as used to host a phishing lure. |
| DOMAIN | r[.]brandreward[.]com | Link-tracking and redirection host identified as used to hide phishing-link destinations. |
| DOMAIN | track[.]tec35[.]com | Link-tracking and redirection host identified as used to hide phishing-link destinations. |
| DOMAIN | www[.]hits2babi[.]com | Link-tracking and redirection host identified as used to hide phishing-link destinations. |
| DOMAIN | www[.]taskade[.]com | Third-party site identified as used to host a phishing lure. |
| IPV4 | 162[.]220[.]232[.]223 | Railway IP listed as a source of OAuth activity, active as of March 19 across one organization. |
| IPV4 | 162[.]220[.]232[.]235 | Railway IP associated with SAML and OAuth token activity. |
| IPV4 | 162[.]220[.]232[.]55 | Railway IP listed among the campaign’s OAuth indicators. |
| IPV4 | 162[.]220[.]232[.]57 | Railway IP associated with token-replay activity. |
| IPV4 | 162[.]220[.]232[.]99 | Railway IP identified as a source of SAML authentication replay. |
| IPV4 | 162[.]220[.]234[.]161 | Railway IP listed among the campaign’s authentication indicators. |
| IPV4 | 162[.]220[.]234[.]34 | Railway IP listed among the campaign’s authentication indicators. |
| IPV4 | 162[.]220[.]234[.]41 | Railway IP identified as the primary token-attack engine and a source of attacker authentication activity. |
| IPV4 | 162[.]220[.]234[.]66 | Railway IP associated with device-code and token-replay activity. |
MITRE ATT&CK
T1204.001 · Malicious LinkVictims followed phishing links and entered device codes to access purported files or documents.T1528 · Steal Application Access TokenVictims entered attacker-generated device codes into Microsoft’s legitimate authorization flow, allowing the attacker’s backend to receive OAuth tokens.T1550.001 · Application Access TokenThe campaign replayed harvested OAuth tokens from Railway infrastructure, including automated refresh-token exchanges.T1566.002 · Spearphishing LinkPersonalized email lures delivered links to phishing pages, including links routed through URL-rewriter services and redirect chains.T1584.001 · DomainsThe article reports compromised organization websites injected with redirect pages and used as hops in the phishing chains.
People
Aaron DealAcknowledged for contributions to the investigation and write-up.Casey SmithAcknowledged for contributions to the investigation and write-up.Dave KleinatlandNamed author of the Huntress investigation.Erin MeyersNamed author of the Huntress investigation.Jamie LevyNamed author of the Huntress investigation.Matt KielyAcknowledged for contributions to the investigation and write-up.Rich MozeleskiNamed author of the Huntress investigation.Tanner FilipAcknowledged for contributions to the investigation and write-up.
Vendors
Ciscovendor redirect services. The email arrives with a Cisco, Trend Micro, or Mimecast URL in the bodyCloudflarecustomers with Open Redirect links to vulnerable domains, through which CloudFlare workers fromHuntressthe community, Huntress has attributed the Railway attack to the EvilTokens Phishing as a ServiceMicrosoftHomeBlogRiding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack InfrastructureMimecastvendor redirect services. The email arrives with a Cisco, Trend Micro, or Mimecast URL in the bodyRailwayHomeBlogRiding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack InfrastructureTrend Microvendor redirect services. The email arrives with a Cisco, Trend Micro, or Mimecast URL in the body
Products
Cloudflare Workerscustomers with Open Redirect links to vulnerable domains, through which CloudFlare workers fromMicrosoft 365 Apps for EnterpriseHomeBlogRiding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack InfrastructureMicrosoft Dynamics 365Abuse of Microsoft Dynamics 365 “Customer Voice” featureMicrosoft Entra IDeligible tenants (i.e., tenants with Microsoft Entra ID P1 and Security Defaults disabled) toMicrosoft SentinelMicrosoft Sentinel — Railway login hunt (interactive):RailwayHomeBlogRiding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure
Tools
Countries
AustraliaMicrosoft 365 identities across more than 340 organizations in the US, Canada, Australia, NewCanadaMicrosoft 365 identities across more than 340 organizations in the US, Canada, Australia, NewGermanyZealand, and Germany. The first case appeared on February 19, followed by two more on February 24.New ZealandCountries US, Canada, Australia, New Zealand, Germany
Industries
Construction and Tradesthe victim list includes 24 construction and trades organizations, suggesting deliberate sectorFinance / InsuranceFinance / Insurance 12Government / Public SafetyGovernment / Public Safety 8HealthcareHealthcare 11 Medical records, HIPAA-sensitive dataIndigenous / First NationsIndigenous / First Nations 4 Land rights, resource agreements, community trust fundsLabor UnionsLabor Unions 2 Member PII, collective bargaining strategy, PAC fundsLaw firmssigns of slowing down, impacting organizations of all types and sizes, from law firms toManufacturingManufacturing 14Nonprofit / Social ServicesNonprofit / Social Services 15real estateReal Estate 14 Transaction records, wire routing information