Cloudflare Workers EvilTokens Phishing Campaign Detection

Ethan Andrews@eandrews

•updated Mar 24, 2026•38•0•643

Detects web requests to Cloudflare workers.dev subdomains containing specific keywords commonly used in the EvilTokens device code phishing campaign. The rule specifically looks for a pattern like '[lure-type]-[3char-id].[username]-[domain]...workers.dev' to identify malicious URLs.