https://detection.fyi/sigmahq/sigma/emerging-threats/2026/malware/eviltokens/ Recent content in EvilTokens on Detection.FYI Hugo -- gohugo.io Wed, 01 Jul 2026 09:39:33 +0000 https://detection.fyi/sigmahq/sigma/emerging-threats/2026/malware/eviltokens/proxy_eviltokens_cloudflare_worker_request/ Wed, 01 Jul 2026 09:39:33 +0000 https://detection.fyi/sigmahq/sigma/emerging-threats/2026/malware/eviltokens/proxy_eviltokens_cloudflare_worker_request/ Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure. Specifically Cloudflare Workers and Railway.app domains used in OAuth device code authorization phishing attacks. This indicates a user has clicked a phishing link.