Kali365 / EvilTokens - /api/device/start Endpoint Network Traffic

Ibrahim Saud@tektrix

•updated Jun 20, 2026•6•0•12

Detects network traffic fetching device codes from the Kali365 backend, specifically targeting the '/api/device/start' or '/api/device/status/' endpoints. This activity is associated with the EvilTokens device code phishing kit.