Threat Intelligence / Actor / EvilTokens / NOIRLEGACY GROUP

EvilTokens / NOIRLEGACY GROUP

Nation: N/A · 1 tracked threat(s) · Categories: PHISHING

Also known as: EvilTokens, NOIRLEGACY GROUP, EvilTokens PhaaS

Tracked threats

EvilTokens PhaaS Campaign Abuses Railway.com PaaS for Microsoft 365 Device Code Phishing and AiTM Token Replay — CRITICAL

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence