Arctic Wolf Tracking Threat Actors Abusing Railway PaaS for Microsoft 365 Token Compromise

Arctic Wolf warns of an active EvilTokens phishing campaign targeting Microsoft 365 that leverages the OAuth device code flow and hosts attack components on Railway PaaS to steal access and refresh tokens, bypass multi‑factor authentication, and maintain persistent access; hundreds of organizations have been impacted. Recommended mitigations include blocking Device Code Flow with Conditional Access where not required, restricting it to specific networks/devices/users when needed, enabling sign‑in risk policies, and implementing phishing-focused security awareness training.