EvilTokens Hides Its Attack Flow in the Browser, Exposing Static Analysis Gaps  

EvilTokens is a device-code phishing kit that delivers an AES-GCM encrypted phishing page which is decrypted and rendered client-side, hiding the Microsoft-branded OAuth device-code prompt from static URL analysis; the report demonstrates how browser-level sandboxing (ANY.RUN) reveals the full attack chain, associated HTTP requests, DOM changes, and IOCs to support faster triage, detection, and response.