EvilTokens Ghost Code AES-GCM Phishing Page with Device Code API Endpoints

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

This rule detects network communication with infrastructure associated with the 'EvilTokens' phishing kit, specifically targeting Microsoft OAuth device code API endpoints (/api/device/*) hosted on workers.dev. This behavior is indicative of an adversary conducting device code phishing (a form of AitM attack) to obtain unauthorized access tokens.