"Ghost" Code Phishing Analysis

Reported 23 Jun 2026 by otx · Severity: medium

EvilTokens is a sophisticated phishing kit that conceals critical components of its attack through browser-side AES-GCM encryption, creating visibility gaps for traditional static URL analysis. The kit exploits Microsoft's legitimate device login flow through OAuth device-code ph