Railway

Reported Context (4)

the Eastern District of Virginia, Microsoft and Health-ISAC worked with Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation and TRM Labs to seize 50 websites used to operate the service and Microsoft-Led Operation Disrupts EvilTokens Phishing Service That Compromised 12,000 Inboxes
powered by Claude Opus 4.6 deleted the company's production database and volume-level backups through a Railway API operation while working on a task intended for staging. Reporting on the incident describes the agent Enterprise AI Agents’ Cyber Capabilities Make Governance and Access Controls Critical
2. Legitimate infrastructure is the new cover. The Railway/EvilTokens campaign used a real cloud platform, real Microsoft auth flows, and AI-generated lures to hit 340+ organizations with no two identical phishing How Social Engineering Exploits Trusted Identities, Platforms, and Workflows
HomeBlogRiding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure Huntress Links Microsoft 365 Device-Code Phishing Campaign to EvilTokens

CVE (2)

Malware (1)

People (14)

MITRE ATT&CK (5)

Vendors (17)

Products (18)

Tools (1)

Industries (14)

Countries (7)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.