As reported by The Hacker News, a sophisticated phishing campaign dubbed EvilTokens is actively targeting organizations across the United States and Europe using a technique that fundamentally sidesteps how most enterprise email security tools operate. At Shield53, we've been tracking a broader shift in adversary tradecraft toward what we're calling deferred payload execution — and this campaign is one of the clearest examples of that shift going mainstream.
Why This Is a Different Kind of Threat
Traditional email security operates on a straightforward principle: inspect URLs and attachments at the point of delivery, detonate suspicious links in a sandbox, and block what looks dangerous. That model depends on the malicious content being visible and evaluable at scan time. Ghost phishing breaks that assumption entirely.
By keeping the malicious landing page encrypted or obfuscated until it reaches the victim's browser — and only then decrypting and rendering the credential-harvesting interface — EvilTokens effectively turns the end user's device into the sandbox. No pre-delivery scanner sees the true payload. The URL that passes your secure email gateway's reputation check is, at inspection time, genuinely inert. The danger only materializes after the click, inside a live browser session.
This isn't a minor evasion tweak. It represents a structural attack on the trust model that email security vendors have built their products around for the past decade.
Who Is Most Exposed
The campaign's focus on Microsoft 365 credentials makes the exposure profile particularly broad. Any organization relying on M365 for email, collaboration, SharePoint, or identity — which is the majority of mid-to-large enterprises in the US and Europe — carries meaningful risk here. But certain profiles face elevated danger:
The Deeper Strategic Implication
What EvilTokens signals to the security community isn't just a new phishing variant to add to your threat intel feed — it's evidence that the attacker community is systematically reverse-engineering enterprise security architecture and designing around it. When attackers understand your detection dependencies well enough to invalidate them by design, signature updates and new URL reputation feeds are insufficient responses.
The question defenders need to ask isn't "did our gateway catch this?" — it's "what visibility do we have after the email is delivered and the link is clicked?"
Post-delivery detection capabilities — browser isolation, endpoint detection of credential form submissions, identity anomaly detection in Entra ID / Azure AD, and conditional access policies — are no longer optional layers for security-mature organizations. They are the primary defense line against this class of attack.
Shield53 Recommendations
Immediate Actions
- Enforce phishing-resistant MFA across all M365 accounts — FIDO2/hardware keys or certificate-based auth where possible. SMS and authenticator app push are better than nothing but remain bypassable via AiTM proxy attacks that often accompany campaigns like this.
- Enable Microsoft Defender for Office 365 Safe Links with "do not allow users to click through" settings, and ensure time-of-click URL evaluation is active — this provides a second inspection opportunity post-delivery.
- Deploy Conditional Access policies that restrict M365 access to compliant, managed devices and flag sign-ins from unusual locations or IP ranges immediately following email click events.
- Review Entra ID sign-in logs for anomalous authentication patterns — particularly token theft indicators such as impossible travel, new device registrations, or OAuth app consent grants following suspicious email activity.
Longer-Term Defensive Posture
- Invest in browser-level telemetry or enterprise browser solutions that can detect credential form submissions to non-corporate domains, regardless of whether the URL was flagged at delivery time.
- Conduct tabletop exercises and phishing simulations specifically designed around ghost phishing mechanics — employees need to understand that a "clean" looking page that appeared from a clicked email link is not inherently safe.
- Evaluate your email security vendor's post-delivery remediation capabilities — the ability to retroactively pull messages and alert on clicked URLs is increasingly essential.
- Implement user and entity behavior analytics (UEBA) integrated with M365 audit logs to detect post-compromise activity even when the initial phish evades all pre-delivery controls.
The EvilTokens campaign is a forcing function for security teams to honestly assess whether their email security investment matches the current threat landscape — or whether it's optimized for the attacks of five years ago. Ghost phishing won't be the last technique designed to exploit the gap between delivery-time inspection and runtime execution. Build defenses that close that gap now.
