New Ghost Phishing Wave Is Breaking Traditional Email Security
Summary: A recent EvilTokens campaign targeting businesses in the US and Europe uses a "ghost phishing" technique in which the malicious page's HTML is encrypted with AES-GCM and only becomes visible after the victim's browser decrypts and renders it in the DOM. The kit relies on Microsoft Device Code Phishing to walk victims through a legitimate Microsoft login flow and authorize account access without stealing the password directly.
What you should know: Static URL checks and network-level controls can capture the initial response without seeing what the employee actually sees, and ANY.RUN's sandbox data from 15,000 organizations puts 2026 phishing exposure at 75.6% in consulting, 72.8% in financial services, and 66.1% among MSSPs - so one compromised Microsoft 365 account can become business email compromise before the SOC has evidence to act on.
Read the original at The Hacker News ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026