Loading story…
Huntress reported a sustained 2026 wave of device code phishing that used infrastructure from BL Networks—also known as BitLaunch or BLNWX—to target Microsoft 365 users through abused authentication flows. The activity first appeared in Huntress telemetry on April 13, 2026, initially centered on IP 216.203.20[.]95, then expanded across multiple BL Networks IP ranges and remained active through late July. Researchers said the campaign relied on legitimate-looking hosting and successful device code sign-ins rather than malware delivery, allowing attackers to obtain and abuse user sessions after victims completed the authentication process.
The infrastructure overlap is notable because BL Networks has also been examined as an anonymous VPS provider attractive to criminal operators, including ransomware actors seeking harder-to-trace hosting. Huntress compared the activity to an earlier Railway-linked wave associated with the EvilTokens phishing-as-a-service platform and said the latest operations show continued adaptation rather than a wholly new technique. Defenders were urged to prioritize behavioral detection—such as unusual device code sign-ins, repeated successful logins from suspicious hosting providers, and immediate token or session revocation after suspected compromise—over campaign naming or branding.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Between July 3 and July 27, 2026, Huntress saw 26 critical-severity incidents linked to BL Networks spanning 23 identities, showing the activity was ongoing into late July.
In May 2026, Huntress observed the BL Networks-linked activity expand from a single IP address to several IPs across multiple subnets, including 193.149.176[.]151, 193.149.176[.]238, and 45.61.136[.]129.
Huntress began seeing suspicious Microsoft 365 authentication activity linked to BL Networks on April 13, 2026, marking its first observed malicious authentication activity from that provider.
Between April 13 and April 30, 2026, Huntress identified 533 events tied to BL Networks from IP address 216.203.20[.]95.
BL Networks, also known as BitLaunch or BLNWX, has been active since at least 2017 as a VPS reseller offering Linux and Windows VPS services.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports describe **phishing-led malware delivery** that abuses trusted services and “living off the land” execution paths to evade controls and deploy remote access tooling. Cloudflare-tracked activity shows attackers using **Vercel-hosted** pages to lend legitimacy to malicious links and bypass email/security filtering, with lures themed around invoices, payments, shipping, and document portals; the infrastructure includes **Telegram-based filtering** and browser fingerprinting/conditional delivery to hinder researchers and sandboxes before serving payloads that install a **remote access tool (RAT)**. A separate campaign (tracked as **PHALT#BLYX**) targets hospitality staff with Booking[.]com-style reservation emails and uses a **fake browser error + fake BSOD** to coerce victims into running the **ClickFix** technique (Win+R paste/execute), launching PowerShell that pulls malicious project files and executes them via **`MSBuild.exe`** to deliver **DCRat**, consistent with **LOLBins**-based evasion; researchers noted Russian-language artifacts in the malware. Broader weekly/newsletter roundups also highlight the same risk theme—attackers increasingly blend social engineering with trusted infrastructure and tools—while mixing in unrelated items (e.g., firewall CVEs, general malware research links) that are not part of a single, specific incident narrative.
Jun 29, 2026
The phishing-as-a-service platform **EvilTokens** sharply expanded attacks against Microsoft 365 accounts by abusing Microsoft’s legitimate **device code OAuth flow** to steal access tokens after victims completed real Microsoft logins and multi-factor authentication. Huntress reported a **1,380% increase** in device code phishing activity between late 2025 and early 2026, with campaigns affecting hundreds of organizations. The operation used **AI-generated personalized phishing lures** and automated post-compromise analysis to support follow-on business email compromise, while relying on legitimate cloud services including **Railway**, **BL Networks/BitLaunch**, and **Cloudflare Workers** to blend in with normal traffic. EvilTokens was marketed openly on **Telegram** as a subscription service priced from **$600 to $1,500**, lowering the barrier for less sophisticated criminals to launch token-theft campaigns that can bypass MFA protections. Huntress said **57.5%** of observed attacks were tied to Railway or BL Networks infrastructure, and that blocking Railway IP addresses through Conditional Access prevented more than **600 incidents** before attackers shifted hosting. Defenders were urged to restrict or block device code authentication where possible, review sign-in logs for suspicious Railway-originated authentications, revoke stolen tokens, audit Microsoft Graph API activity, and update user awareness training because genuine Microsoft login pages can still be part of a phishing attack.
Jun 29, 2026
Multiple reports highlight **social engineering and phishing** as primary initial-access vectors, with attackers increasingly targeting **identity systems** rather than exploiting software vulnerabilities. Microsoft was again the most spoofed brand in phishing during Q4 2025 (22% of observed brand-impersonation attempts), reflecting how attackers abuse trust in major identity and productivity platforms to harvest credentials; examples cited include lures mimicking Netflix account recovery, Roblox-related pages, and Spanish-language Facebook scams. Separately, an incident response case described payroll fraud achieved without malware or a network breach: an attacker impersonated employees to help desks, reset passwords, re-enrolled MFA, and registered an external email as an authentication method in **Azure Active Directory**, then altered direct-deposit details to redirect paychecks—underscoring how **help-desk processes and MFA reset workflows** can be exploited for persistence and financial theft. Targeted campaigns also show continued evolution in delivery tradecraft for **remote access**. A spear-phishing operation against Argentina’s judicial sector used ZIP attachments containing a weaponized Windows shortcut (`.lnk`) masquerading as a PDF plus scripts and a decoy court document to deploy a **Remote Access Trojan** while minimizing user suspicion. In parallel, research described **Pulsar RAT** (a Quasar RAT derivative) emphasizing stealth via **memory-only execution** and **HVNC**, with TLS-encrypted C2 and configuration retrieval from public paste sites, alongside persistence mechanisms such as scheduled tasks and UAC-bypass techniques. Another campaign attributed to **Konni APT** (“Operation Poseidon”) abused **Google and Naver ad redirection** (e.g., `ad.doubleclick[.]net`, `mkt.naver[.]com`) to launder clicks through trusted ad infrastructure before landing victims on compromised sites hosting malware, demonstrating how open-redirect and ad-tech trust can bypass reputation-based controls.
Jun 29, 2026