EvilTokens PhaaS Kit Phishing Related Request - Proxy

Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure. Specifically Cloudflare Workers and Railway.app domains used in OAuth device code authorization phishing attacks. This indicates a user has clicked a phishing link.

title: EvilTokens PhaaS Kit Phishing Related Request - Proxy
id: e0e121d0-be4d-4281-af7e-17abbba4a408
status: experimental
description: |
    Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure.
    Specifically Cloudflare Workers and Railway.app domains used in OAuth device code authorization phishing attacks.
    This indicates a user has clicked a phishing link.
references:
    - https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/
author: uniqu3-us3r
date: 2026-04-28
tags:
    - attack.initial-access
    - attack.t1566.002
    - detection.emerging-threats
logsource:
    category: proxy
detection:
    selection:
        c-uri|re: '-[a-z0-9]{3}\.[a-z0-9-]{3,}-s-account\.workers\.dev|\.up\.railway\.app'
    condition: selection
falsepositives:
    - Legitimate use of Cloudflare Workers or Railway.app domains
level: low

• T1566.002Spearphishing Link

• https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/↗