{"id":1655,"date":"2026-07-08T14:07:40","date_gmt":"2026-07-08T14:07:40","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1655"},"modified":"2026-07-08T14:07:40","modified_gmt":"2026-07-08T14:07:40","slug":"new-ghost-phishing-wave-is-breaking-traditional-email-security","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1655","title":{"rendered":"New Ghost Phishing Wave Is Breaking Traditional Email Security"},"content":{"rendered":"
\n
<\/a><\/div>\n

A recent EvilTokens campaign targeting businesses across the US and Europe is exposing a new email security blind spot. This \u201cghost phishing\u201d technique keeps the malicious page hidden until it decrypts and comes to life inside the victim\u2019s browser.<\/p>\n

For security leaders, the risk is clear: traditional URL checks may miss the attack while Microsoft 365 access, sensitive data, and response time are already at stake.<\/p>\n

The Email Looks Safe. The Browser Tells a Different Story<\/h2>\n

A recent EvilTokens attack shows how a phishing link can appear harmless during initial inspection while still leading to Microsoft 365 account takeover.<\/p>\n

The kit uses Microsoft Device Code Phishing to convince victims to complete a legitimate Microsoft login flow and unknowingly authorize access to their accounts. It does not need to steal the password directly.<\/p>\n

The real attack remains hidden until the page opens in the browser. Its HTML is encrypted with AES-GCM and becomes visible only after the browser decrypts it and renders the phishing content in the DOM.<\/p>\n

As a result, static URL checks and network-level controls may capture the initial response without seeing what the employee actually sees. This visibility gap can lead to:<\/p>\n