Proxy requests to EvilTokens PhaaS phishing domains (Cloudflare Workers, Railway.app)

Alerts on proxy requests to Cloudflare Workers or Railway.app URLs associated with EvilTokens phishing PhaaS kit infrastructure.

FreeReviewedSigma · Low · v5

Category: proxy
Author: uniqu3-us3r (SigmaHQ), DRL 1.1
Published: 2026-04-28
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1566.002Spearphishing Link
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies outbound web proxy requests where the requested URL matches specific Cloudflare Workers and Railway.app patterns associated with EvilTokens phishing-as-a-service infrastructure. Such infrastructure is used to carry out device code authorization phishing, which can capture credentials or authorization responses after a user clicks a phishing link. The detection relies on proxy telemetry containing the full request URL.

Reporting behind it

Related detections9 linkedT1566.002 — drag to rearrange

Suspicious Microsoft Entra Device Code Authentication Flow

Suspicious Windows Script Host Execution of JavaScript from Temporary Archive Extraction Folder (via process_creation)

Suspicious OAuth Application Consent Grant via Azure Audit Logs

Suspicious OWA Proxy User-Agent Indicating Mailbox Access

Suspicious Anonymous Sharing Link Creation in SharePoint or OneDrive via M365 Audit

Suspicious Screensaver File Executed as Installer via process_creation

Suspicious M365 Device Code Authentication Flow via m365

Malicious GTFire Phishing Credential Exfiltration to All-in-1.php Backend (via proxy)

Suspicious 1Phish Kit Cookies and Telemetry Beacon

Proxy requests to EvilTokens PhaaS phishing domains (Cloudflare Workers, Railway.app)

Pivot detection · T1566.002 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

proxy-outbound-request-to-eviltokens-phaas-phishing-infrastructure-cloudflare-wo-e0e121d0

title: Proxy requests to EvilTokens PhaaS phishing domains (Cloudflare Workers, Railway.app)
id: 84124b2a-6173-4855-893a-6c6d2bb8b526
status: experimental
description: This rule identifies outbound web proxy requests where the requested URL matches specific Cloudflare Workers and Railway.app patterns associated with EvilTokens phishing-as-a-service infrastructure. Such infrastructure is used to carry out device code authorization phishing, which can capture credentials or authorization responses after a user clicks a phishing link. The detection relies on proxy telemetry containing the full request URL.
references:
  - https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/EvilTokens/proxy_eviltokens_cloudflare_worker_request.yml
author: uniqu3-us3r, Huntrule Team
date: 2026-04-28
tags:
  - attack.initial-access
  - attack.t1566.002
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    c-uri|re: -[a-z0-9]{3}\.[a-z0-9-]{3,}-s-account\.workers\.dev|\.up\.railway\.app
  condition: selection
falsepositives:
  - Legitimate use of Cloudflare Workers or Railway.app domains
level: low
license: DRL-1.1
related:
  - id: e0e121d0-be4d-4281-af7e-17abbba4a408
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL