Kali365 / EvilTokens - Workers.dev Subdomain Phishing Pattern

Ibrahim Saud@tektrix

•updated Jun 20, 2026•5•0•12

Identifies network connections to algorithmically generated Cloudflare Workers domains used by Kali365, specifically targeting the `-s-account.workers.dev` format. This pattern is indicative of phishing campaigns, potentially for credential harvesting or token replay.