New EvilTokens Attack Exposes Browser Visibility Gap in Enterprise SOCs

ANY.RUN reports on the EvilTokens phishing campaign that targets enterprise Microsoft 365 users in the US and Europe across industries (banking, technology, education, manufacturing, financial services, MSSPs). The campaign abuses Microsoft’s OAuth device-code workflow and hides the phishing page as an AES-GCM-encrypted payload which is only revealed after browser-side JavaScript decrypts and renders it, creating a visibility gap for SOC teams; ANY.RUN’s interactive sandbox can expose the full workflow within about a minute to aid detection and response.