Loading story…
Researchers identified ZeroTokens, an operator-controlled phishing platform that impersonates financial institutions and lets attackers monitor victim sessions live, altering prompts during multi-stage credential and identity-harvesting flows. The platform relays submitted data through persistent WebSocket connections to an operator console, enabling immediate use of stolen credentials and time-sensitive one-time passwords against genuine institutions. Its institution-specific templates cover 53 financial brands across 14 locales and can collect credentials, identity documents, payment-card details, MFA codes, mobile-app approvals, and trading passwords.
An observed campaign used W-8BEN tax-documentation review lures aimed at recipients with U.S. securities holdings, delivering more than 45,000 emails to over 24,000 recipients across 700-plus organizations. Attackers abused 10 sender domains and nine SendGrid accounts; the messages passed SPF, DKIM, and DMARC checks, helping evade conventional email controls. Researchers assess with high confidence that ZeroTokens is bespoke tooling operated by a single criminal group, likely supporting downstream withdrawal fraud, payment-destination changes, and brokerage-account takeover.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Abnormal AI published analysis describing ZeroTokens as an operator-controlled phishing platform that uses persistent WebSocket connections to relay victim inputs and lets operators alter verification prompts in real time. Researchers assessed that it was very likely in-house tooling for a single criminal group rather than a phishing-as-a-service offering.
Attackers used the ZeroTokens platform in a W-8BEN tax-documentation phishing campaign, delivering more than 45,000 messages to over 24,000 recipients across more than 700 organizations. The operation abused nine SendGrid accounts and ten sender domains, with emails passing SPF, DKIM, and DMARC checks.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Huntress reported that the **EvilTokens** phishing-as-a-service operation used Microsoft’s legitimate device code authentication flow to steal valid session tokens from users without capturing passwords or directly breaking MFA. The campaign accelerated in early March after initial alerts in late February and affected **344 organizations across five countries over 16 days**. According to Huntress and Microsoft, the operation relied on trusted cloud infrastructure hosted on Railway and phishing lures tailored to victims’ normal workflows, allowing the activity to blend in with legitimate sign-in behavior. Researchers said EvilTokens is marketed on Telegram and uses **AI-enhanced phishing** to personalize messages, evade email filtering, identify financially valuable targets, and automate follow-on fraud using context taken from compromised accounts. Because the emails, URLs, and authentication steps appeared legitimate, traditional email defenses often failed to stop the attacks. Huntress recommended behavior-based detection, stricter Conditional Access policies, monitoring for suspicious device registrations, rapid token revocation, and wider adoption of phishing-resistant MFA such as **FIDO2** security keys and passkeys.
Jun 29, 2026
Phishing-as-a-service platforms continued to industrialize account takeover operations, with kits such as **Tycoon2FA**, **EvilProxy**, **Sneaky 2FA**, **CryptoChameleon**, **Darcula**, **Evilginx**, and **EvilTokens** enabling attackers to steal credentials, session cookies, MFA responses, payment-card data, and OAuth tokens at scale. Reporting across 2025 and 2026 described more than a million PhaaS attacks in a two-month period, a possible **CryptoChameleon** social-engineering campaign targeting LastPass and cryptocurrency users, and a targeted adversary-in-the-middle campaign against **RBC Express** online banking customers that used malvertising and cloaking to bypass multi-factor authentication. Researchers also documented a shift from fake login pages toward token theft and abuse of legitimate authentication workflows. A July 2026 analysis tied a bulk phishing platform dubbed **Mailer-Go Mission Control** to **EvilTokens** operations abusing Microsoft's OAuth device-code flow, while sector reporting said AiTM phishing had become the top initial access vector for law firms, with **Tycoon2FA** responsible for over half of AiTM-related compromises in that sector during 2025 despite a March 2026 disruption. The combined reporting warned that modern phishing kits lower the barrier to entry with automation, domain management, and real-time victim interaction, and recommended **phishing-resistant MFA** such as FIDO2/WebAuthn, conditional access, managed-device controls, and rapid revocation of compromised sessions and refresh tokens.
Aug 15, 2026
Researchers reported that the **EvilTokens** phishing-as-a-service platform is being used to steal Microsoft 365 access tokens through OAuth **device code phishing**, with one campaign abusing free **Notion** accounts and malicious PDFs to lure victims. In the activity tracked as **Doubloon Dredger**, attackers sent legitimate-looking Notion document-sharing notifications from compromised accounts impersonating senior executives, then redirected targets to phishing pages disguised as Adobe Acrobat authentication prompts. Victims were instructed to enter a verification code on Microsoft’s legitimate sign-in or device code page, allowing Microsoft to issue authorization tokens directly to the attackers without requiring password theft. The operation has targeted organizations in manufacturing, telecommunications, retail, healthcare, and logistics, and researchers said EvilTokens has been active since at least February 2026 and is marketed largely through Telegram. Flare said the platform goes beyond session theft by analyzing compromised mailboxes, using AI to summarize content and identify likely fraud opportunities, and helping operators craft tailored business email compromise messages based on real payment workflows and relationships. Reported activity included a 16-day wave affecting **344 organizations across five countries**, while separate research found more than **1,000** infrastructure-related search results and **66** email attachments leading to EvilTokens pages; defenders were urged to restrict or disable device-code authentication where possible and monitor for anomalous token grants, inbox rule creation, mailbox searches, token reuse, and suspicious outbound email.
Aug 25, 2026