EvilTokens: How “Ghost” Code Threatens US and European Businesses

This report analyzes EvilTokens, a phishing kit that hides its malicious landing page using AES-GCM browser-side decryption and leverages Microsoft OAuth device-code flow to obtain Microsoft 365 account access without harvesting passwords; it shows how ANY.RUN’s interactive sandbox reveals decrypted DOM content, traces requests to endpoints such as /api/device/start, /api/device/status and /api/device/gate/<PAGE_ID>, and extracts IOCs and signatures to help SOCs and MSSPs triage, detect, and respond to targeted campaigns in the United States and Europe.