Malware2026

EvilTokens

1Rules

1References

1Folders

2026-04-28Latest

Summary

EvilTokens is tracked here as a malware family or toolset with 1 Sigma detection spanning 2026. Coverage centers on proxy.

Related Detections

Search this threat

Emerging Threatlowexperimental

EvilTokens PhaaS Kit Phishing Related Request - Proxy

Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure. Specifically Cloudflare Workers and Railway.app domains used in OAuth device code authorization phishing attacks. This indicates a user has clicked a phishing link.

Proxy Log

TA0001 · Initial AccessT1566.002 · Spearphishing Linkdetection.emerging-threats

uniqu3-us3rTue Apr 282026

References

Resolving title…

blog.sekoia.io