EvilTokens AES-GCM payloads decrypt post-delivery to run Microsoft device code flows undetected by static filters

The campaign hides malicious content until the victim’s browser executes the decryption and injects the phishing DOM. Initial server responses return only ciphertext, bypassing URL reputation lists and network proxies. Sandbox sessions from ANY.RUN captured the subsequent Fetch request to /api/device/start and the user code display that triggers OAuth consent without password capture. Sectors showed exposure rates above 66 percent in 15,000 tracked organizations, with consulting at 75.6 percent. Device code flows have appeared in prior tracked incidents since 2023; the encryption layer adds a new delivery concealment step rather than a novel authorization abuse. Procurement records and contract awards for email security tools still emphasize pre-delivery URL inspection, creating a measurable detection lag against in-browser execution. Operators gain extended dwell time before containment because alerts lack the decrypted payload evidence.