EvilTokens Phishing Kit 'Killed' Gate Check Wiping Page via /api/device/gate/

Ethan Andrews@eandrews

•updated Jun 23, 2026•10•0•21

Detects network traffic associated with the EvilTokens phishing kit's 'killed' gate check mechanism. The kit GETs /api/device/gate/<PAGE_ID> with the ngrok-skip-browser-warning header. When the backend returns a killed flag, the phishing page wipes the DOM and renders a fake 'Page Not Found - Microsoft' error to evade analysis or block specific victims.