EvilTokens Campaign BAV2ROPC Token Refresh Auth via Railway PaaS

Bryant Smith@flowstate

•updated Mar 24, 2026•6•0•435

Detects programmatic token refresh activity using the BAV2ROPC user agent originating from Railway IP space. This indicates automated persistent token cycling mechanisms used by the EvilTokens Phishing-as-a-Service (PhaaS) campaign to maintain access to compromised Microsoft 365 accounts.