Railway

Reported Context (4)

Railway. LSHIY. Different Auth Flows, but the Same Lesson We Keep Skipping Huntress Details Conditional Access Gaps Behind Railway and LSHIY Microsoft 365 Attacks
2. Legitimate infrastructure is the new cover. The Railway/EvilTokens campaign used a real cloud platform, real Microsoft auth flows, and AI-generated lures to hit 340+ organizations with no two identical phishing How Social Engineering Exploits Trusted Identities, Platforms, and Workflows
By early 2026, attackers were already using platforms like Railway to spin up session token theft infrastructure on demand, impacting hundreds of organizations globally in a matter of weeks. Attackers Are Building Workflows Around AI, Not Just Using AI Tools
HomeBlogRiding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure Huntress Links Microsoft 365 Device-Code Phishing Campaign to EvilTokens

Malware (1)

People (16)

MITRE ATT&CK (5)

Vendors (7)

Products (14)

Tools (1)

Industries (11)

Countries (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.