Authentication from EvilToken Infrastructure (HZ Hosting)

Ibrahim Saud@tektrix

•updated Jun 18, 2026•0•0•5

Detects successful user authentications originating from known EvilToken infrastructure hosted on HZ Hosting. This activity is indicative of potential credential compromise or phishing attacks leveraging this specific infrastructure.