Learn how Ransomware-as-a-Service works, why it's dangerous, and how to protect your organization from this growing cybercrime model.
What Is Phishing-as-a-Service (PhaaS)?
Written by: Lizzie Danielson
Published: 9/12/2025
Summarize This PageOn This Page
Summarize This PageOn This Page
Managed ITDR Demo
Learn more about Unwanted Access
Phishing kits are cheap. A breach isn't. See how Huntress detects and responds to phishing attacks for you.
Real-world example: EvilTokens and the Railway campaign
In February 2026, Huntress researchers spotted something unusual: a wave of anomalous authentication events hitting dozens of Microsoft 365 organizations at the same time.
What they uncovered was a PhaaS platform later attributed toEvilTokens—advertised on Telegram starting February 16, 2026, with pricing tiers for email delivery, token capture, and SMTP relay. Within days of going public, it was actively compromising organizations.
The attack method was device code phishing—a technique that exploits Microsoft's own OAuth device authorization flow. Instead of stealing a password, the attacker tricks the victim into entering a code at Microsoft's legitimate login page. The attacker's backend then retrieves the resulting access and refresh tokens, which stay valid for up to 90 days—even after a password reset.
Here's what made it especially hard to catch:
-
It bypassed MFA entirely. Users authenticated on a real Microsoft page, so MFA did exactly what it was supposed to—and it still didn't stop the attack.
-
The infrastructure looked clean. Railway.com is a legitimate Platform-as-a-Service provider with clean cloud IP ranges. Because Railway had no reputation penalty, Microsoft's risk scoring didn't flag it as suspicious.
-
Every phishing email was different. Construction bid lures, DocuSign impersonation, voicemail notifications, Microsoft Forms abuse—all hitting the same victim pool with no two messages alike. Signature-based email filters didn't stand a chance.
By mid-March 2026, the campaign had hit more than 340 organizations across the US, Canada, Australia, New Zealand, and Germany—spanning law firms, manufacturers, healthcare providers, financial services firms, and local governments.
Huntress blocked more than 460 compromise attempts across protected identities during the campaign, as new blocks continued to roll in—113 recent attempts on top of roughly 350 earlier compromises.
See this in action by watching the video below:
For organizations without that kind of identity-level detection, many didn't know they'd been hit until it was too late.
How to defend against phishing attacks
PhaaS-powered phishing is designed to get around your defenses one by one. That's why no single control is enough. You need layers—and they all need to work together.
Security awareness training
Your people are your first line of defense—and your biggest target. Train them to be skeptical of unsolicited emails, especially ones that create urgency. Teach them to verify sender addresses, pause before clicking links, and recognize that even legitimate-looking Microsoft pages can be part of a phishing chain.
Huntress Managed Security Awareness Training delivers expert-backed training, phishing simulations, and just-in-time Phishing Defense Coaching based on real-world threat intel to reduce human risk and build resilience.
Multi-factor authentication (MFA)
MFA is non-negotiable—but campaigns like EvilTokens are a reminder that MFA alone isn't a complete defense. Token-based attacks can bypass MFA entirely if you're not also monitoring authentication behavior and restricting which flows are allowed.
If you need a primer or asset to share with leadership, Huntress’ guide,What Is Multi-Factor Authentication?, explains why MFA is “necessary but not sufficient” and how attackers are already working around it.
Advanced email security
Deploy email filtering that goes beyond simple keyword matching. You need solutions that analyze email headers, scan for malicious links and attachments, and use behavioral analysis to catch phishing attempts that look clean on the surface—because modern PhaaS kits deliberately abuse trusted redirectors, URL rewriters, and reputable cloud services to evade basic checks.
Endpoint Detection and Response (EDR)
If a user does click something malicious, you need to know about it before the threat spreads.
Huntress Managed EDR continuously monitors endpoints for malicious behavior, persistent footholds, lateral movement, and early signs of ransomware, then brings in a 24/7 AI-assisted SOC to contain and actively remediate threats—often in minutes.
Identity Threat Detection and Response (ITDR)
This is the one most organizations don't have—and the one modern PhaaS attacks are specifically designed to exploit.
Huntress Managed ITDR monitors your Microsoft 365 and Google Workspace environments for session hijacking, token replay, rogue OAuth apps, unusual locations and VPNs, malicious inbox rules, and other identity anomalies that show up even when everything else looks clean.
If EvilTokens—or the next PhaaS platform—hit your organization, ITDR is how you'd catch it in your authentication telemetry, revoke tokens, and shut down attacker access before they can pivot to wire fraud or data theft.
FAQs About Phishing-as-a-Service
Absolutely. Creating, selling, or using PhaaS tools is a form of cybercrime and is illegal in most countries. It facilitates crimes like identity theft, fraud, and data breaches.
Prices vary widely. Some basic kits can be found for as little as $50, while more sophisticated monthly subscriptions with customer support can run into the hundreds or even thousands of dollars.
A regular phishing attack is executed from start to finish by a single person or group. PhaaS separates the roles: one group develops and sells the tools, and another group (the customer) buys and uses them to launch the attack.
Yes and no. Advanced email security can block many PhaaS-based attacks, but the operators are constantly evolving their techniques to evade detection. This cat-and-mouse game is why a layered defense, including user education, is crucial.
The customer base is broad. It includes low-skilled cybercriminals (often called "script kiddies"), organized crime groups looking to scale their operations, and even disgruntled insiders who want an easy way to attack their employer.
Additional Resources
- Read more about What is Ransomware-as-a-Service (RaaS)? Complete Guide
- Read more about What is Spear Phishing?Discover what spear phishing is, how it works, and prevention tips to protect your organization. Sign up for Huntress’ Free Security Awareness Training today.
- Read more about Black Hat Hacking Explained + Ways to Stay ProtectedLearn what black hat hackers do, how they operate, and the best cybersecurity practices to protect yourself or your organization from their tactics.
- Read more about What Is Phishing? How Phishing Scams Affect BusinessesDiscover what phishing is, its impact on businesses, and how to protect against phishing attacks with actionable strategies and tools like Huntress.
- Read more about What Is an Attack Vector (and Why Should You Care)?Learn more about what an attack vector is, the different methods threat actors use, and how to secure your organization against them.
- Read more about What Is SEO Poisoning? | Huntress Cybersecurity 101Learn about SEO Poisoning, a cybersecurity threat where attackers manipulate search results to spread malware or phishing links.
- Read more about Initial Access in Cybersecurity: The Attack Stage Most Businesses MissEvery cyberattack starts somewhere. Learn how threat actors gain initial access to your systems, the techniques they use, and what your team can do to detect and block them early.
- Read more about Keystroke LogginKeystroke logging records everything you type on your keyboard. Learn how it works, the risks it poses, and how to protect yourself from keyloggers.
- Read more about What Is Remote Code Execution (RCE)? How to Prevent ItLearn what remote code execution (RCE) is, how attackers exploit RCE vulnerabilities through injection, deserialization, and buffer overflow attacks, and the proven strategies you need to protect your systems.
