Ghost phishing: when an email looks safe, but the attack comes alive in the browser

Colleagues, I’d like to highlight an important trend in cybersecurity: ghost phishing.

In EvilTokens, the malicious page remains hidden until the browser decrypts it and renders the content. The email and link may look harmless, while traditional URL checks reveal nothing.

Microsoft 365 accounts, corporate email, and cloud services are at risk. Attackers do not always need a password: they exploit a legitimate login flow and gain access through the browser.

Why it matters: without browser-level analysis, the SOC may lose time and act on incomplete data.

How do you verify suspicious links — by URL only, or already with browser behavior in mind?

#cybersecurity #phishing #Microsoft365 #SOC