Researchers at ANY.RUN have spent the past several weeks documenting a phishing kit called EvilTokens, active since at least February 2026 and sold through Telegram channels, that hides its Microsoft 365 credential-theft pages behind real browser-grade encryption. The technique, which analysts are calling ghost phishing, ships the malicious page as AES-GCM ciphertext and a short JavaScript decryptor, and nothing that looks like a phishing page exists until a victim’s own browser runs that script and calls the Web Crypto API to render it. Secure email gateways, URL sandboxes, and static scanners that inspect a page without executing its JavaScript see only an opaque blob and a few lines of generic decryption code. The campaign has hit organizations across finance, consulting, and manufacturing in the United States and Europe, and ANY.RUN’s sandbox data puts 2026 phishing exposure at 75.6% in consulting and 72.8% in financial services, the two sectors ghost phishing is landing in hardest.
How Ghost Phishing Works
A conventional phishing kit sends its login form as plain HTML the moment a scanner or a browser requests the page, which is exactly what lets automated defenses catch it: fetch the URL, read the markup, flag the fake Microsoft branding and password field. EvilTokens skips that step. The page’s actual content, the branded login form, the field labels, the instructions, is encrypted client-side with AES-GCM before it ever touches the wire. What a scanner receives when it requests the URL is ciphertext that means nothing on its own, wrapped around a small decryption routine written in ordinary JavaScript calling the Web Crypto API, a feature built into every modern browser for legitimate cryptographic operations. Only when that script actually runs, inside a real browser, with a key baked into the page or delivered separately, does the ciphertext turn into a working phishing form in the DOM. A tool that fetches the URL and reads the raw response, which describes most static scanners and many secure email gateway link-checkers, never sees that transformation happen and scores the page clean.
Paired With Device-Code Phishing for the Payoff
EvilTokens does not stop at hiding its login form. The campaign frequently pairs ghost phishing with Microsoft’s OAuth 2.0 device-code flow, the same abuse pattern behind the DEBULL and ARToken kits this newsletter covered on July 11. A victim who reaches the decrypted page is walked through entering a device code on Microsoft’s own real sign-in page, approving what looks like a routine authentication prompt. The attacker’s backend, polling in the background, receives a valid access token the moment the victim clicks approve, no password stolen, no credential harvesting page a defender could point to after the fact. Ghost phishing solves the delivery problem, getting the lure past automated scanning, and device-code abuse solves the credential problem, getting a working session without ever needing one.
Why This Matters for DMARC
DMARC, SPF, and DKIM answer one question: did this message travel through infrastructure the domain owner authorized to send on its behalf. They say nothing about what a link inside that message leads to, and they were never designed to. A ghost phishing email can be sent from genuinely compromised infrastructure, a legitimate but abused sending service, or a domain with no authentication at all, and DMARC enforcement on the recipient side will correctly sort out which of those it is. What DMARC cannot touch is the payload behind the link once the message clears that check. Secure email gateways have historically closed part of that gap by fetching and inspecting linked pages at the moment of delivery or click, which is precisely the layer ghost phishing is built to blind. The message can be perfectly authenticated, or perfectly rejected, independent of whether the URL inside it resolves to something dangerous. Those are two separate defensive questions, and EvilTokens is a reminder that solving one does not touch the other.
What Defenders Should Do
Move link inspection from static fetch to full rendering. A scanner needs to execute the page’s JavaScript and observe the resulting DOM, not just read the initial HTTP response, to see what a ghost-phishing page actually becomes. Time-of-click protection that detonates URLs in an instrumented browser sandbox catches this where a static content check cannot.
Restrict the device-code authentication flow. Conditional Access policies can scope or disable OAuth device-code sign-in for users who do not need it, which removes the payoff mechanism EvilTokens depends on even if the lure itself gets through.
Watch for encrypted or obfuscated page payloads as a signal on their own. A landing page whose response body is unreadable ciphertext plus a minimal decryption script is an unusual pattern for legitimate sites and is itself worth flagging, independent of what the decrypted content turns out to be.
Keep DMARC enforcement at reject and treat it as one layer, not the whole stack. Strict DMARC still stops the far more common case of an outsider forging your domain outright. It was never going to be the layer that catches an encrypted payload riding on legitimate or compromised infrastructure, and no amount of DMARC tuning changes that.
The Takeaway
Ghost phishing does not break DMARC, SPF, or DKIM. It targets a completely different link in the chain: the automated content inspection that secure email gateways rely on to judge whether a URL is safe before a human ever clicks it. Encrypting the payload until it reaches a real browser is a direct, deliberate answer to scanners that only ever look at raw HTTP responses. Email authentication and link-content inspection solve different problems, and EvilTokens is a clear demonstration of why an organization needs both working, not either one covering for the other.
Excello Mail gives you continuous visibility into your DMARC aggregate reports and every source authorized to send as your domain, so authentication stays one layer of defense you can actually trust while your team hardens the rest of the stack against tricks like encrypted phishing payloads. Sign up for free to Excello Mail to get that visibility in place.