Proxy outbound request to EvilTokens PhaaS phishing infrastructure (Cloudflare Workers/Railway)

title: Proxy outbound request to EvilTokens PhaaS phishing infrastructure (Cloudflare Workers/Railway)
id: 84124b2a-6173-4855-893a-6c6d2bb8b526
status: experimental
description: This rule flags outbound proxy requests where the destination URL matches EvilTokens PhaaS phishing-related infrastructure, including Cloudflare Workers and Railway.app domains tied to OAuth device code authorization phishing. Such traffic can indicate a user followed a phishing link that directs them to attacker-controlled web endpoints. Detection relies on proxy telemetry containing the requested URI and applies a pattern match against the specific worker and Railway domain formats.
references:
  - https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/EvilTokens/proxy_eviltokens_cloudflare_worker_request.yml
author: uniqu3-us3r, Huntrule Team
date: 2026-04-28
tags:
  - attack.initial-access
  - attack.t1566.002
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    c-uri|re: -[a-z0-9]{3}\.[a-z0-9-]{3,}-s-account\.workers\.dev|\.up\.railway\.app
  condition: selection
falsepositives:
  - Legitimate use of Cloudflare Workers or Railway.app domains
level: low
license: DRL-1.1
related:
  - id: e0e121d0-be4d-4281-af7e-17abbba4a408
    type: derived