EvilTokens: The Phishing Page That Only Exists in Your Browser

There's a new phishing technique making the rounds, and it's built specifically to slip past the tools most businesses rely on to catch this stuff. Researchers are calling it ghost phishing. The campaign behind it, EvilTokens, is hitting targets across the US and Europe, and the trick is elegant in a way that's genuinely uncomfortable.

The malicious page doesn't exist in any form a scanner can read. When an email security tool fetches the URL to inspect it, all it gets is an encrypted blob. Nothing to flag, nothing to match against a signature, nothing to warn on. The phishing content only assembles itself once the victim's browser decrypts it and renders it live in the DOM.

How the encryption trick works

The kit uses AES-GCM encryption to hide the payload in transit. Static URL checks see gibberish. Network filters see gibberish. The employee, meanwhile, sees a very convincing Microsoft login prompt built out in front of them a fraction of a second after the page loads.

This isn't a novel cryptographic breakthrough. It's just a clever bit of misdirection that turns the browser itself into the delivery mechanism for the malicious content. And because most email defences are looking at the URL rather than what the browser eventually renders, they miss it.

The payload is worse than a password grab

Here's where EvilTokens gets nasty. Instead of harvesting credentials, it uses Microsoft Device Code Phishing. The victim is walked through a genuine Microsoft login flow, on Microsoft's real infrastructure, and prompted to authorise a device.

The attacker never asks for a password. They never need one. The victim, believing they're completing an ordinary sign-in, authorises access to their own Microsoft 365 account and hands the session token straight to the attacker. Multi-factor authentication doesn't help here, because the victim is completing MFA themselves as part of the flow.

Who's getting hit

ANY.RUN's exposure figures for the year give a clear picture of where this is landing:

• Consulting: 75.6%
• Financial services: 72.8%
• Manufacturing: 71.9%
• Managed security providers: 66.1%

These are sectors where a single compromised mailbox is rarely just a single compromised mailbox. It becomes invoice fraud, data theft, or, in the case of MSPs and consultancies, a doorway into every client downstream.

Where the decision actually lands

The awkward truth in this one is that the email carrying the link can pass every automated check and still be malicious. There is nothing for the scanner to see until a browser opens the page, and by then the tooling has already handed the decision to a person.

Which means the last line of defence, again, is whoever is looking at the screen and deciding whether that Microsoft prompt feels right.