A new wave of Microsoft 365 attacks ships phishing pages as scrambled code that looks harmless to automated scanners and only reveals itself once a real browser opens the link.

 

What happened

A recent EvilTokens campaign targeting businesses across the United States and Europe is exposing a gap in how traditional email security tools inspect suspicious links. According to The Hacker News, the technique, described as ghost phishing, keeps the malicious page hidden until it decrypts and comes to life inside the victim's browser. The kit uses Microsoft device code phishing, the technique in which a victim is walked through what looks like a normal Microsoft sign-in step and unknowingly hands over account access without ever typing a password. What makes this version different is what happens before that step even loads. The page's underlying code is encrypted using a method called AES-GCM and only becomes visible after the browser itself decrypts and displays it. A static scan of the link, the kind most email security tools rely on to check whether a URL is dangerous before delivery, sees only scrambled code, not the actual phishing content a person would see.

 

Going deeper

This creates a real gap for security teams relying on automated URL checks and network-level filtering, since those tools typically inspect a page's response without rendering it the way a browser does. That means a link can pass an initial automated check while still leading directly to account takeover once a real person opens it. The Hacker News says that the visibility gap tends to produce longer exposure before anyone notices an account has been compromised, delayed decisions about how to respond, and more uncertain cases getting escalated to senior security staff because junior analysts cannot tell from the initial scan alone whether the link was actually dangerous. Once inside a compromised Microsoft 365 account, an attacker gains the same access a legitimate device code login would grant, covering email, files, and other connected cloud services.

 

What was said

The Hacker News reported that recent EvilTokens activity is concentrated across the United States and Europe, with the technology, manufacturing, education, banking, consulting, financial services, and managed security provider sectors most affected. The article cited sandbox submission data covering 15,000 organizations showing phishing exposure in 2026 reaching above 75% in consulting and above 70% in both financial services and manufacturing, underscoring how broadly these sectors were already being targeted before this specific hidden-page technique was identified.

 

In the know

EvilTokens has been one of the most active Microsoft 365 phishing platforms of 2026. According to BleepingComputer, the kit is sold to cybercriminals over Telegram and remains under continuous development, with its author stating plans to extend the same device code phishing approach to Gmail and Okta accounts as well. Microsoft VP of security research Tanmay Ganacharya told The Register that since mid-March 2026, Microsoft has observed 10 to 15 distinct EvilTokens-linked campaigns launching every 24 hours, each distributed at scale with payloads varied enough to make pattern-based detection difficult, and that hundreds of compromises are occurring daily across affected organizations.

 

The big picture

Healthcare organizations checking a suspicious link once and treating a clean initial scan as proof of safety are exposed to exactly the gap this technique is built around. A billing coordinator or clinical administrator who receives a link that passed an automated security check has no reason to hesitate before clicking it, even though the actual danger only appears once their own browser opens the page. According to Paubox's 2026 Healthcare Email Security Report, 53% of breached healthcare organizations in 2025 used Microsoft 365, putting the platform that this specific technique targets at the center of the sector's existing exposure. A single compromised account can carry patient scheduling data, billing communications, and internal clinical correspondence, all of which become accessible the moment a device code login is completed.

 

FAQs

Why does encrypting the phishing page's code help attackers avoid detection?

Most automated link-scanning tools inspect the raw response a webpage returns before it is displayed to a user. If that response is encrypted, the scanner sees only unreadable scrambled text rather than the actual phishing content, and has no way to determine the page is malicious without rendering it the way a real browser would.

 

What is device code phishing, and why doesn't it require stealing a password?

Device code phishing abuses a legitimate Microsoft feature meant for devices without a keyboard, such as smart TVs or printers, that lets a user approve a sign-in using a short code entered on a separate device. Attackers generate that code themselves and trick a victim into entering it on Microsoft's real login page, which hands the attacker a valid session without ever needing the victim's password.

 

Why does this technique lead to slower incident response, even when it's eventually caught?

When an initial automated scan cannot confirm whether a link is dangerous, security teams are left working from incomplete information. Analysts have to escalate uncertain cases, investigate manually to see what a real browser would show, and reconstruct what happened after the fact rather than blocking the threat immediately based on a clear automated result.

 

What sectors have been most affected by this specific EvilTokens activity?

Recent activity has concentrated on organizations in technology, manufacturing, education, banking, consulting, financial services, and managed security providers across the United States and Europe, sectors that already show some of the highest overall phishing exposure rates recorded in 2026.

 

What can security teams do to close the visibility gap this technique creates?

Because static link scanning alone cannot see what a page looks like after it decrypts in a browser, security teams need tools capable of opening suspicious links in a controlled environment and observing what actually renders, rather than relying solely on the page's initial response before any browser-side decryption occurs.