EvilTokens PhaaS Workers.dev Lure Subdomains

Bryant Smith@flowstate

•updated Mar 24, 2026•5•0•458

Detects web requests to Cloudflare workers.dev subdomains containing specific keywords commonly used in the EvilTokens phishing campaign lures. Attackers rely on this PaaS platform to host device code phishing pages and bypass domain reputation checks.