New Ghost Phishing Wave Is Breaking Traditional Email Security

Published:

8 juli 2026 om 13:00:00

Alert date:

8 juli 2026 om 15:06:43

Source:

thehackernews.com

Email & Messaging, Identity & Access, Web Technologies

A new phishing campaign called EvilTokens is targeting businesses across the US and Europe using a technique dubbed 'ghost phishing.' The attack conceals malicious pages until they are decrypted and rendered inside the victim's browser, bypassing traditional URL-based email security checks. This approach creates a blind spot for conventional email security tools that rely on static URL analysis. The primary targets appear to be Microsoft 365 credentials and sensitive organizational data. Security leaders are warned that response time is critical as traditional defenses may fail to detect the threat. The campaign represents an evolution in phishing methodology designed to evade pre-delivery scanning.

Technical details

The EvilTokens campaign uses a 'ghost phishing' technique that targets businesses in the US and Europe. The attack employs Microsoft Device Code Phishing to trick victims into completing a legitimate Microsoft login flow, unknowingly authorizing attacker access to their Microsoft 365 accounts without stealing passwords directly. The phishing page's HTML content is encrypted using AES-GCM encryption, meaning the malicious content remains hidden until the victim's browser decrypts and renders it in the DOM. This causes static URL checks and network-level controls to only capture the encrypted response, missing the actual phishing content. The attack communicates with Microsoft's /api/device/start endpoint via Fetch/XHR requests to initiate the device code flow. The attack flow is only fully visible through in-browser analysis, such as sandbox environments capable of inspecting DOM changes and HTTP requests post-decryption. Phishing exposure rates in 2026 by sector (from ANY.RUN's 15,000 organization dataset): Consulting 75.6%, Financial Services 72.8%, Manufacturing 71.9%, Technology 67.9%, Banking 66.7%, MSSPs 66.1%.

Mitigation steps:

1. Use interactive sandbox environments (e.g., ANY.RUN) with in-browser data inspection capabilities to analyze suspicious URLs, as static URL checks and network-level controls will miss AES-GCM encrypted phishing pages. 2. Monitor DOM changes, Fetch/XHR requests, and HTTP traffic to the Microsoft /api/device/start endpoint for signs of device code phishing abuse. 3. Review and restrict Microsoft Device Code Authentication flow usage within your organization, particularly for external or unexpected flows. 4. Implement browser-level visibility tools to detect phishing content that only renders after client-side decryption. 5. Escalate suspicious links through sandbox analysis to generate IOCs (domains, endpoints, hashes, infrastructure) for blocking and threat hunting. 6. Enable automated investigation reporting to streamline Tier 1 to Tier 2 SOC handoffs and reduce investigation time. 7. Prioritize phishing detection improvements for high-exposure sectors: consulting, financial services, manufacturing, technology, banking, and MSSPs. 8. Shrink exposure windows by ensuring analysts have full browser-level evidence before making containment decisions rather than relying on clean URL scans or inconclusive verdicts.

Affected products:

Microsoft 365
Microsoft Device Code Authentication Flow