EvilTokens PhaaS Kit Phishing Related Request - Proxy

Description

Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure. Specifically Cloudflare Workers and Railway.app domains used in OAuth device code authorization phishing attacks. This indicates a user has clicked a phishing link.

Query · sigma

selection:
  c-uri|re: -[a-z0-9]{3}\.[a-z0-9-]{3,}-s-account\.workers\.dev|\.up\.railway\.app
condition: selection

Known false positives

  • Legitimate use of Cloudflare Workers or Railway.app domains
Raw source EvilTokens PhaaS Kit Phishing Related Request - Proxy · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: EvilTokens PhaaS Kit Phishing Related Request - Proxy
id: e0e121d0-be4d-4281-af7e-17abbba4a408
status: experimental
description: |
    Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure.
    Specifically Cloudflare Workers and Railway.app domains used in OAuth device code authorization phishing attacks.
    This indicates a user has clicked a phishing link.
references:
    - https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/
author: uniqu3-us3r
date: 2026-04-28
tags:
    - attack.initial-access
    - attack.t1566.002
    - detection.emerging-threats
logsource:
    category: proxy
detection:
    selection:
        c-uri|re: '-[a-z0-9]{3}\.[a-z0-9-]{3,}-s-account\.workers\.dev|\.up\.railway\.app'
    condition: selection
falsepositives:
    - Legitimate use of Cloudflare Workers or Railway.app domains
level: low

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.