# EvilTokens PhaaS Campaign Abuses Railway.com PaaS for Microsoft 365 Device Code Phishing and AiTM Token Replay

> An active Phishing-as-a-Service (PhaaS) campaign operated by EvilTokens leverages Railway.com PaaS infrastructure to conduct device code phishing and Adversary-in-the-Middle (AiTM) token replay attacks against Microsoft 365 identities. The campaign has compromised 350+ accounts across 340+ organizations in five countries, with attack tempo accelerating and no signs of slowing.

- **Published:** 2026-03-24T12:00:00Z
- **Last reviewed:** 2026-03-24T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0278
- **ID:** TL-2026-0278
- **Severity:** CRITICAL
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** EvilTokens
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The EvilTokens Phishing-as-a-Service (PhaaS) platform, first advertised on the NOIRLEGACY GROUP Telegram channel on February 16, 2026, has been weaponizing Railway.com — a legitimate Platform-as-a-Service (PaaS) provider — as clean, disposable infrastructure for a large-scale Microsoft 365 credential theft campaign combining device code phishing and Adversary-in-the-Middle (AiTM) token replay.

The attack chain exploits the OAuth device authorization flow (RFC 8628), a legitimate Microsoft authentication mechanism designed for input-constrained devices such as smart TVs, printers, and kiosk terminals. Attackers generate device codes server-side, then deliver AI-crafted phishing lures — including emails, QR codes, co-opted file-share sites, and custom file download prompts — that direct victims to the legitimate microsoft.com/devicelogin portal. When the victim enters the 8-character code and completes MFA on the real Microsoft login page, the attacker’s backend immediately captures a valid OAuth token set: an access token for immediate resource access and a refresh token valid for up to 90 days. Because the victim authenticates directly with Microsoft, traditional MFA is completely bypassed — no credentials are ever entered on a phishing page.

The EvilTokens platform offers three products: a B2B Sender, an Office 365 Capture Link, and an SMTP Sender. Both the B2B Sender and Capture Link feature AI workflows that bypass email filtering, tailor phishing lures to individual targets, and scan compromised mailboxes for sensitive emails useful in wire fraud or data exfiltration. The platform also provides customers with Open Redirect links to vulnerable domains, through which Cloudflare Workers from the Office 365 Capture Link product steal additional credentials from new victims, creating a self-propagating attack chain.

Railway.com serves as the force multiplier in this campaign. The PaaS platform enables prompt-based deployment of containerized attack infrastructure with automatic TLS, clean IP reputation, and no identity verification — allowing attackers to spin up and tear down credential-harvesting services in minutes. Authentication events originate from a narrow block of Railway IP addresses hosted on Google Cloud Platform (GCP) us-west1 infrastructure. The replay engine rotates through a curated set of user-agent strings that mimic realistic enterprise browser populations to evade uniform UA detection rules.

Post-compromise, attackers leverage stolen tokens for Primary Refresh Token (PRT) acquisition by registering attacker-controlled devices in Entra ID via the Microsoft Authentication Broker client ID. This grants persistent access to organizational resources even after password resets. The campaign targets organizations of all types and sizes — law firms, construction companies, nonprofits, real estate, manufacturing, finance, insurance, healthcare, government, and public safety — across the United States, Canada, Australia, New Zealand, and Germany.

Huntress, in partnership with Flare.io, attributed the Railway-based infrastructure to the EvilTokens PhaaS platform. The campaign shares tactical similarities with Storm-2372, a Russia-linked threat group that has conducted device code phishing since August 2024, though EvilTokens appears to operate as a commercially motivated PhaaS offering rather than a state-sponsored operation. As of March 23, 2026, Huntress had documented approximately 350 compromises and blocked 113 additional attempted compromises, with the campaign showing no signs of deceleration.

## MITRE ATT&CK

- T1566 Phishing
- T1528 Steal Application Access Token
- T1539 Steal Web Session Cookie
- T1557 Adversary-in-the-Middle
- T1550 Use Alternate Authentication Material
- T1684.001 Impersonation
- T1098 Account Manipulation
- T1078 Valid Accounts
- T1114 Email Collection
- T1530 Data from Cloud Storage
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1567 Exfiltration Over Web Service
- T1102 Web Service
- T1657 Financial Theft

## Sources

- [Riding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure](https://www.huntress.com/blog/railway-paas-m365-token-replay-campaign)
- [An AI-powered phishing campaign has compromised hundreds of organizations](https://cyberscoop.com/huntress-railway-ai-phishing-campaign-compromised-hundreds-of-organizations/)
- [Huntress Blocks Device Code Phishing from Railway Infrastructure](https://blog.saltdata.ro/huntress-device-code-phishing-railway-block)
- [Storm-2372 conducts device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)
- [Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale](https://www.microsoft.com/en-us/security/blog/2026/03/04/inside-tycoon2fa-how-a-leading-aitm-phishing-kit-operated-at-scale/)
- [Investigating an adversary-in-the-middle phishing campaign targeting Microsoft 365 and Okta users](https://securitylabs.datadoghq.com/articles/investigating-an-aitm-phishing-campaign-m365-okta/)
- [Resurgence of a multi-stage AiTM phishing and BEC campaign abusing SharePoint](https://www.microsoft.com/en-us/security/blog/2026/01/21/multistage-aitm-phishing-bec-campaign-abusing-sharepoint/)
- [Access granted: phishing with device code authorization for account takeover](https://www.proofpoint.com/us/blog/threat-insight/access-granted-phishing-device-code-authorization-account-takeover)
- [OAuth redirection abuse enables phishing and malware delivery](https://www.microsoft.com/en-us/security/blog/2026/03/02/oauth-redirection-abuse-enables-phishing-malware-delivery/)
- [Inside Adversary-in-the-Middle Attacks](https://www.huntress.com/blog/unmasking-the-central-villain-inside-adversary-in-the-middle-attacks)
- [Device Code Phishing in Google Cloud and Azure](https://www.huntress.com/blog/oh-auth-2-0-device-code-phishing-in-google-cloud-and-azure)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0278