EvilTokens PhaaS Kit Phishing Related Request - Proxy

Status: experimental
Severity: low
Log source: category proxy
Author: uniqu3-us3r
Source: github.com/SigmaHQ/sigma

Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure. Specifically Cloudflare Workers and Railway.app domains used in OAuth device code authorization phishing attacks. This indicates a user has clicked a phishing link.

Known false positives

Legitimate use of Cloudflare Workers or Railway.app domains

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1566.002` Phishing: Spearphishing Link

Rule body

title: EvilTokens PhaaS Kit Phishing Related Request - Proxy
id: e0e121d0-be4d-4281-af7e-17abbba4a408
status: experimental
description: |
    Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure.
    Specifically Cloudflare Workers and Railway.app domains used in OAuth device code authorization phishing attacks.
    This indicates a user has clicked a phishing link.
references:
    - https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/
author: uniqu3-us3r
date: 2026-04-28
tags:
    - attack.initial-access
    - attack.t1566.002
    - detection.emerging-threats
logsource:
    category: proxy
detection:
    selection:
        c-uri|re: '-[a-z0-9]{3}\.[a-z0-9-]{3,}-s-account\.workers\.dev|\.up\.railway\.app'
    condition: selection
falsepositives:
    - Legitimate use of Cloudflare Workers or Railway.app domains
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    c-uri|re: '-[a-z0-9]{3}\.[a-z0-9-]{3,}-s-account\.workers\.dev|\.up\.railway\.app'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`c-uri`	regex_match	`-[a-z0-9]{3}.[a-z0-9-]{3,}-s-account.workers.dev` `.up.railway.app`	`field:"c-uri" kind:regex_match`