# New "Ghost Phishing" Wave Exposes Critical Blind Spot in Email Security


## A Silent Threat You Can't See in Transit


A sophisticated phishing campaign dubbed EvilTokens is exploiting a fundamental vulnerability in how modern email security works. The attack, which targets organizations across the United States and Europe, uses a technique called "ghost phishing" to hide malicious content from detection until the message reaches a victim's browser—after it has already bypassed traditional security controls.


Security researchers have documented how attackers are crafting emails that appear benign to automated scanners but transform into fully functional phishing pages once opened, immediately targeting Microsoft 365 credentials and sensitive business data. The technique represents a meaningful escalation in attacker sophistication, one that leaves security teams with a dangerous gap between what they can detect and what users actually see.


## The Threat: Ghost Phishing Explained


Ghost phishing is a novel evasion technique that exploits the gap between email gateway scanning and browser-based rendering. Here's how it works:


Traditional phishing detection:

  • Email security gateways scan messages in transit
  • URL reputation databases are checked
  • Known malicious domains are blocked
  • Suspicious content is flagged or quarantined

    • Ghost phishing bypasses all of this:

  • Malicious content is encrypted or obfuscated in the email
  • The email passes through gateways looking harmless
  • Decryption or content generation happens only in the recipient's browser
  • By the time the phishing page is visible, security controls have already passed it

    • The result is a phishing attack that exists in a state of quantum uncertainty—invisible to security infrastructure, fully realized only when seen by human eyes.


    ## Technical Details: How EvilTokens Works


    The EvilTokens campaign uses several complementary techniques to remain hidden:


    | Attack Stage | Mechanism | Detection Difficulty |

    |---|---|---|

    | Email Delivery | Encrypted payload in email body or attachment | Very Low (passes standard scans) |

    | Decryption Trigger | JavaScript executes on message open | Medium (requires browser execution analysis) |

    | Page Rendering | Malicious HTML/CSS builds form UI in browser memory | High (dynamic, not transmitted as static file) |

    | Credential Capture | Real-time interception of Microsoft 365 login attempt | Very High (happens post-delivery) |


    Key technical aspects:


  • Payload encryption: The malicious HTML/JavaScript is stored in encrypted form within the email, making it invisible to content-based detection engines
  • Conditional execution: Decryption keys or rendering logic may depend on recipient metadata (email domain, client type), allowing attackers to target specific organizations
  • Browser-based rendering: The phishing page is constructed dynamically in the victim's browser using JavaScript, never appearing as a traditional "phishing URL"
  • Direct credential capture: Instead of redirecting to an external phishing server, captured credentials may be sent directly via the victim's own email client, bypassing network-level detection

    • ## Background and Context: The EvilTokens Campaign


    The EvilTokens campaign has been active since at least early 2026, targeting organizations across multiple sectors in North America and Europe. Key details:


    Campaign scope:

  • Estimated thousands of messages sent to business accounts across finance, healthcare, technology, and manufacturing sectors
  • Focus on mid-sized organizations (100-5,000 employees) where phishing awareness training may be less rigorous
  • Microsoft 365 is the primary target, reflecting its near-ubiquitous adoption in enterprise environments

    • Attacker objectives:

  • Steal corporate email credentials for lateral movement
  • Establish persistent access to exchange mail systems
  • Harvest business email compromise (BEC) opportunity data
  • Potential secondary monetization through credential sales

    • Campaign sophistication:

  • Use of legitimate-looking company branding (often spoofing IT departments, HR, or facilities)
  • Timing around common business events (password resets, security updates, new device provisioning)
  • Minimal payload size and content diversity to avoid pattern-based detection

    • Researchers attribute the campaign to a cybercriminal group with previous experience in business email compromise (BEC) and credential harvesting operations.


    ## Implications for Organizations


    The ghost phishing technique creates several critical risks:


    1. Email Gateway Failure

  • Expensive, multi-layer email security solutions miss these attacks entirely
  • Organizations may have false confidence in their email protections
  • Existing email filters and URL reputation systems provide little defense

    • 2. Detection Blind Spot

  • Security teams cannot easily identify which users received malicious emails
  • No compromised URL to blacklist or block retroactively
  • Email audit logs may show the message but not its malicious nature

    • 3. Speed of Compromise

  • The attack moves from inbox to credential theft in seconds
  • Traditional incident response workflows (quarantine the email, notify users) are ineffective
  • By the time security teams are alerted, credentials may already be exfiltrated

    • 4. Microsoft 365 Exposure

  • Compromised accounts grant immediate access to corporate email, Teams, OneDrive, and SharePoint
  • Attackers can pivot to sensitive files, emails, and communications without setting off alerts
  • Multi-factor authentication (MFA) may or may not prevent access, depending on configuration

    • 5. Downstream Risks

  • Compromised accounts enable business email compromise (BEC) attacks against customers and partners
  • Attackers gain visibility into payment flows, contracts, and vendor relationships
  • Long-term persistent access enables espionage or data exfiltration campaigns

    • ## Recommendations for Defense


    Immediate actions:


  • Review email security logs for anomalous decryption or JavaScript execution patterns
  • Audit Microsoft 365 access for unfamiliar login locations, devices, or times
  • Check for forwarding rules or delegate access added to compromised accounts
  • Verify MFA enforcement across all Microsoft 365 roles and high-value accounts

    • Email protection measures:


  • Disable HTML rendering in email clients where possible (or use client policies that strip executable content)
  • Require email authentication (DMARC, SPF, DKIM) to prevent spoofing
  • Implement URL rewriting and sandboxing for all external links in emails
  • Use advanced email filtering that includes browser-based rendering and behavioral analysis
  • Consider email decryption policies that decrypt and inspect S/MIME or TLS-in-transit encrypted mail before delivery

    • Endpoint and identity controls:


  • Enforce MFA for all accounts, especially administrative and email-access roles
  • Implement conditional access policies that require MFA for mail access from unusual locations or devices
  • Deploy threat intelligence that flags suspicious login patterns to your SIEM
  • Regular credential audits and password rotation for high-risk users
  • Monitor for forwarding rules, delegates, and inbox rules that exfiltrate mail

    • User and team awareness:


  • Phishing training that emphasizes credential theft and the limitations of email security
  • Reporting mechanisms that make it easy for users to flag suspicious emails
  • Incident response playbooks that can be executed immediately upon suspected compromise
  • Communication with business partners about BEC risks and verification procedures

    • ## HackWire Analysis


    The ghost phishing technique represents a meaningful inflection point in email-based attacks, and the EvilTokens campaign shows that attackers have already weaponized it at scale.


    What makes this particularly significant is not the novelty of the technique in isolation—security researchers have theorized about browser-based decryption evasion for years—but rather the wholesale failure of enterprise email security to address it. Organizations spend millions on email gateways that use URL reputation, sandboxing, and content filtering. EvilTokens demonstrates that none of these approaches prevent an attack that is invisible in transit and rendered dynamically by the victim's own client.


    This is a pattern we've seen before: Email is treated as a solved problem, which leads to complacency. The industry certified and shipped defenses against spear-phishing, business email compromise, and attachment-based malware. Each time attackers adapted. Each time the defense industry caught up. But with ghost phishing, there's a fundamental asymmetry: the attack is inherently invisible to infrastructure-based detection because it only exists inside a browser. This is not a bug in a particular email filter; it's a design flaw in how email security architecture works.


    The second critical risk is speed. Credential theft happens in seconds. Modern incident response assumes time to detect, investigate, and respond. A user opens an email, sees a convincing Microsoft 365 login prompt, enters credentials, and the attacker now has a valid token. By the time your email security or SIEM alerts fire, the attacker has already logged in from a new location, added a forwarding rule, and begun harvesting data. The traditional "detect and respond" model breaks down when the attack completes before you know it has started.


    Organizations should accept that their email gateways cannot defend against this attack. The focus must shift to post-credential controls: MFA enforcement, impossible travel detection, mailbox rule monitoring, and login anomaly detection. If credentials are compromised, you need to know immediately that someone is using them from an unusual location or device, and you need controls that can prevent or restrict access in real time.


    The EvilTokens campaign is likely to inspire copycat operations. The technique will proliferate. This is not a patch-and-move-on kind of threat. Organizations need to fundamentally rethink their email security model, with the assumption that email gateways cannot be a primary line of defense against credential theft.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)