EvilTokens Ghost Phishing Targets US and Europe

A recent EvilTokens campaign uses ghost phishing to hide AES-GCM-encrypted HTML that decrypts only in the browser, bypassing static URL checks. The kit employs Microsoft Device Code Phishing to compromise Microsoft 365 accounts without stealing passwords. ANY.RUN's sandbox data shows phishing exposure rates above 66% across consulting, financial services, manufacturing, technology, banking, and MSSPs.