Proxy requests to EvilTokens PhaaS phishing domains (Cloudflare Workers, Railway.app)

Alerts on proxy requests to Cloudflare Workers or Railway.app URLs associated with EvilTokens phishing PhaaS kit infrastructure.

FreeReviewedSigma · Low · v5

Category: proxy
Author: uniqu3-us3r (SigmaHQ), DRL 1.1
Published: 2026-04-28
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1566.002Spearphishing Link
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies outbound web proxy requests where the requested URL matches specific Cloudflare Workers and Railway.app patterns associated with EvilTokens phishing-as-a-service infrastructure. Such infrastructure is used to carry out device code authorization phishing, which can capture credentials or authorization responses after a user clicks a phishing link. The detection relies on proxy telemetry containing the full request URL.

Reporting behind it

Related detections9 linkedT1566.002 — drag to rearrange

Suspicious Cloudflare Workers Brand-Impersonation Phishing Domains via Proxy

Suspicious NFe-Themed Brazilian Lure Executable Execution

Suspicious Phishing URL with Unrendered Template Placeholder (via proxy)

Suspicious Spoofed Inbound Email With Failed Authentication and Anonymous Internal Sender (via m365)

Malicious Credential Harvesting Request via All-in-1 PHP Endpoint (via proxy)

Suspicious Error 524 Decoy Smishing Phishing Endpoint Access (via proxy)

Suspicious 0ktapus Phishing Kit Credential Post Path Access

Suspicious Entra Device Code Authentication with Office Client and Automated User Agent

Malicious LOLBin Spawned by Outlook via MonikerLink CVE-2024-21413

Proxy requests to EvilTokens PhaaS phishing domains (Cloudflare Workers, Railway.app)

Pivot detection · T1566.002 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

proxy-outbound-request-to-eviltokens-phaas-phishing-infrastructure-cloudflare-wo-e0e121d0

title: Proxy requests to EvilTokens PhaaS phishing domains (Cloudflare Workers, Railway.app)
id: 84124b2a-6173-4855-893a-6c6d2bb8b526
status: experimental
description: This rule identifies outbound web proxy requests where the requested URL matches specific Cloudflare Workers and Railway.app patterns associated with EvilTokens phishing-as-a-service infrastructure. Such infrastructure is used to carry out device code authorization phishing, which can capture credentials or authorization responses after a user clicks a phishing link. The detection relies on proxy telemetry containing the full request URL.
references:
  - https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/EvilTokens/proxy_eviltokens_cloudflare_worker_request.yml
author: uniqu3-us3r, Huntrule Team
date: 2026-04-28
tags:
  - attack.initial-access
  - attack.t1566.002
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    c-uri|re: -[a-z0-9]{3}\.[a-z0-9-]{3,}-s-account\.workers\.dev|\.up\.railway\.app
  condition: selection
falsepositives:
  - Legitimate use of Cloudflare Workers or Railway.app domains
level: low
license: DRL-1.1
related:
  - id: e0e121d0-be4d-4281-af7e-17abbba4a408
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL