EvilTokens PhaaS Campaign Abuses Railway.com PaaS for Microsoft 365 Device Code Phishing and AiTM Token Replay
EvilTokens PhaaS Campaign Abuses Railway.com PaaS for (TL-2026-0278), also tracked as Railway Token Replay Campaign, is a critical-severity phishing campaign, first published 2026-03-24. It is attributed to EvilTokens with high confidence, affects Microsoft Microsoft 365, maps to 15 MITRE ATT&CK techniques (T1078, T1098, T1102), and is covered by 9 detection rules and 17 indicators of compromise.
Key facts for TL-2026-0278
- Threat ID
- TL-2026-0278
- Also known as
- Railway Token Replay Campaign, EvilTokens M365 Campaign
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-03-24
- Last reviewed
- 2026-03-24
- Attribution
- EvilTokens
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- government, legal, construction, nonprofit, real-estate, manufacturing, financial, insurance, healthcare, public-safety, technology, defense
- Target regions
- North America, Europe, Oceania, United States, Canada, Australia, New Zealand, Germany
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in EvilTokens PhaaS Campaign Abuses Railway.com PaaS for
Malware and tooling: EvilTokens B2B Sender, EvilTokens Office 365 Capture Link, EvilTokens PhaaS Platform, EvilTokens SMTP Sender
An active Phishing-as-a-Service (PhaaS) campaign operated by EvilTokens leverages Railway.com PaaS infrastructure to conduct device code phishing and Adversary-in-the-Middle (AiTM) token replay attacks against Microsoft 365 identities. The campaign has compromised 350+ accounts across 340+ organizations in five countries, with attack tempo accelerating and no signs of slowing.
How EvilTokens PhaaS Campaign Abuses Railway.com PaaS for works
The EvilTokens Phishing-as-a-Service (PhaaS) platform, first advertised on the NOIRLEGACY GROUP Telegram channel on February 16, 2026, has been weaponizing Railway.com — a legitimate Platform-as-a-Service (PaaS) provider — as clean, disposable infrastructure for a large-scale Microsoft 365 credential theft campaign combining device code phishing and Adversary-in-the-Middle (AiTM) token replay.
The attack chain exploits the OAuth device authorization flow (RFC 8628), a legitimate Microsoft authentication mechanism designed for input-constrained devices such as smart TVs, printers, and kiosk terminals. Attackers generate device codes server-side, then deliver AI-crafted phishing lures — including emails, QR codes, co-opted file-share sites, and custom file download prompts — that direct victims to the legitimate microsoft.com/devicelogin portal. When the victim enters the 8-character code and completes MFA on the real Microsoft login page, the attacker’s backend immediately captures a valid OAuth token set: an access token for immediate resource access and a refresh token valid for up to 90 days. Because the victim authenticates directly with Microsoft, traditional MFA is completely bypassed — no credentials are ever entered on a phishing page.
The EvilTokens platform offers three products: a B2B Sender, an Office 365 Capture Link, and an SMTP Sender. Both the B2B Sender and Capture Link feature AI workflows that bypass email filtering, tailor phishing lures to individual targets, and scan compromised mailboxes for sensitive emails useful in wire fraud or data exfiltration. The platform also provides customers with Open Redirect links to vulnerable domains, through which Cloudflare Workers from the Office 365 Capture Link product steal additional credentials from new victims, creating a self-propagating attack chain.
Railway.com serves as the force multiplier in this campaign. The PaaS platform enables prompt-based deployment of containerized attack infrastructure with automatic TLS, clean IP reputation, and no identity verification — allowing attackers to spin up and tear down credential-harvesting services in minutes. Authentication events originate from a narrow block of Railway IP addresses hosted on Google Cloud Platform (GCP) us-west1 infrastructure. The replay engine rotates through a curated set of user-agent strings that mimic realistic enterprise browser populations to evade uniform UA detection rules.
Post-compromise, attackers leverage stolen tokens for Primary Refresh Token (PRT) acquisition by registering attacker-controlled devices in Entra ID via the Microsoft Authentication Broker client ID. This grants persistent access to organizational resources even after password resets. The campaign targets organizations of all types and sizes — law firms, construction companies, nonprofits, real estate, manufacturing, finance, insurance, healthcare, government, and public safety — across the United States, Canada, Australia, New Zealand, and Germany.
Huntress, in partnership with Flare.io, attributed the Railway-based infrastructure to the EvilTokens PhaaS platform. The campaign shares tactical similarities with Storm-2372, a Russia-linked threat group that has conducted device code phishing since August 2024, though EvilTokens appears to operate as a commercially motivated PhaaS offering rather than a state-sponsored operation. As of March 23, 2026, Huntress had documented approximately 350 compromises and blocked 113 additional attempted compromises, with the campaign showing no signs of deceleration.
MITRE ATT&CK techniques used in TL-2026-0278
defense-evasion
T1078 Valid Accounts; T1684.001 Impersonation
persistence
command-and-control
collection
T1114 Email Collection; T1530 Data from Cloud Storage
credential-access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle
lateral-movement
T1550 Use Alternate Authentication Material
initial-access
exfiltration
T1567 Exfiltration Over Web Service
resource-development
T1583 Acquire Infrastructure; T1588 Obtain Capabilities
impact
Affected products and versions in EvilTokens PhaaS Campaign Abuses Railway.com PaaS for
- Microsoft — Microsoft 365
Vulnerable versions: All tenants with device code flow enabled - Microsoft — Azure Active Directory / Entra ID
Vulnerable versions: All versions supporting OAuth device code flow - Railway — Railway.com PaaS
Vulnerable versions: Platform abused as attack infrastructure - Cloudflare — Cloudflare Workers
Vulnerable versions: workers.dev domains abused for credential capture
Remediation for EvilTokens PhaaS Campaign Abuses Railway.com PaaS for
Immediate actions
- Block Railway.com CIDR ranges via Azure AD / Entra ID Conditional Access Named Locations
- Block all authentication from Railway IP infrastructure at the identity layer
- Audit all OAuth device code authorizations in the past 90 days for suspicious grants
- Revoke all active refresh tokens for any accounts with Railway-sourced authentication events
- Block known Cloudflare Workers domains (workers.dev) associated with EvilTokens
- Enable Conditional Access policies requiring compliant/managed devices for token issuance
Workarounds
- Restrict device code flow to specific applications via App Registration settings
- Limit OAuth token lifetimes to reduce the window of exploitation
- Use Conditional Access to require device compliance for all token grants
- Block open redirect URLs identified in EvilTokens infrastructure
Longer-term hardening
- Disable or restrict the device code authentication flow in Entra ID unless operationally required
- Implement token protection / Continuous Access Evaluation (CAE) to bind tokens to specific devices
- Deploy identity threat detection and response (ITDR) solutions with device code phishing detection
- Monitor for anomalous PRT registrations and new device enrollments in Entra ID
- Implement phishing-resistant MFA methods (FIDO2 security keys, Windows Hello for Business)
- Configure Conditional Access to block authentication from untrusted cloud PaaS providers
- Establish behavioral baselines for OAuth token activity and alert on deviations
Weaknesses (CWE) in EvilTokens PhaaS Campaign Abuses Railway.com PaaS for
CWE-287, CWE-384, CWE-601
Timeline of EvilTokens PhaaS Campaign Abuses Railway.com PaaS for
- Storm-2372, a Russia-linked threat group, begins device code phishing campaigns against M365, establishing the tactical playbook later adopted by EvilTokens
- Microsoft publishes threat intelligence blog detailing Storm-2372 device code phishing campaign, raising awareness of the technique
- EvilTokens PhaaS platform makes its first public post on the NOIRLEGACY GROUP Telegram channel, advertising device code phishing and AiTM capabilities
- First confirmed compromise from Railway.com infrastructure observed by Huntress SOC via device code flow
- Second wave of compromises detected from Railway infrastructure, indicating campaign operators are scaling operations
- Massive acceleration — Huntress SOC surfaces wave of anomalous authentication events across dozens of organizations simultaneously, revealing full scope of campaign
- Campaign tempo increases to dozens of targets per day with AI-generated unique lures per target, no signs of deceleration
- Huntress contacts Railway.com about platform abuse; Railway begins banning associated accounts and blocking identified domains
- Huntress pushes Conditional Access policy to 60,000 ITDR-protected Microsoft 365 tenants blocking Railway domain authentication
- Huntress publishes full analysis; 350+ compromises across 340+ organizations documented, 113 additional attempts blocked, campaign actively continuing
- As of 2026-05-29, EvilTokens M365 device code phishing remains active and escalating: ASD warned of live targeting on May 21, Microsoft sees 10-15 campaigns daily (37.5x surge), and the kit is still sold on Telegram with no takedown of EvilTokens/NOIRLEGACY. Railway-specific infra was contained by Huntress/Railway, but the actor, PhaaS tooling, and OAuth technique persist.
Sources cited for EvilTokens PhaaS Campaign Abuses Railway.com PaaS for
- Riding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure
- An AI-powered phishing campaign has compromised hundreds of organizations
- Huntress Blocks Device Code Phishing from Railway Infrastructure
- Storm-2372 conducts device code phishing campaign
- Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale
- Investigating an adversary-in-the-middle phishing campaign targeting Microsoft 365 and Okta users
- Resurgence of a multi-stage AiTM phishing and BEC campaign abusing SharePoint
- Access granted: phishing with device code authorization for account takeover
- OAuth redirection abuse enables phishing and malware delivery
- Inside Adversary-in-the-Middle Attacks
- Device Code Phishing in Google Cloud and Azure
Threats related to EvilTokens PhaaS Campaign Abuses Railway.com PaaS for
- Device Code Phishing Surge — 37x Increase Driven by EvilTokens and VENOM PhaaS Kits Targeting Microsoft 365
- EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device Code Authentication with AES-GCM "Ghost Code" to Breach Finance, Tech, and Managed Security Firms
- Device Code Phishing: OAuth Device Authorization Grant Abuse Bypasses All MFA Forms, Including Passkeys
- ARToken Phishing Panel Abuses Microsoft OAuth Device Code Flow to Hijack Microsoft 365 Accounts (EvilTokens PhaaS)
- W3LL Phishing-as-a-Service Ecosystem Dismantled — FBI/Indonesia Takedown of $20M BEC Platform
- Microsoft Entra ID Device Code Phishing — OAuth 2.0 Device Authorization Grant Abuse (Storm-2372, EvilTokens, Kali365)
Detection coverage for TL-2026-0278
As of 2026-03-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0278 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.