EvilTokens and "Ghost Phishing": The Microsoft 365 Attack That Only Materializes Inside the Browser

EvilTokens, a phishing-as-a-service (PhaaS) kit that surfaced in mid-February 2026, chains two techniques that together defeat both static URL scanning and multi-factor authentication. The phishing HT