Kali365 / EvilTokens - Device Code Auth from Railway PaaS IPs

Ibrahim Saud@tektrix

•updated Jun 20, 2026•2•0•5

Detects Device Code Flow authentication originating from abused Railway.com infrastructure, widely abused by Kali365.