Ghost phishing kit
Ghost is our name for AES-GCM loaders that open an encrypted Microsoft device-code lure in the browser. We have matched it on 81 sites since 14 August.
Ghost in numbers
Since 14 August, the first Ghost match in our records, counted on 12 October 2026. How we count.
| Sites with Ghost code | 81 |
|---|---|
| Sites with a match in the last 30 days | 67 |
| New sites in September | 42 |
| Sites captured since 25 September | 41 |
EvilTokens ghost code runs in the browser
ANY.RUN describes an EvilTokens page pattern it calls ghost code: an AES-GCM loader decrypts the page in the browser, then a document lure starts and polls a Microsoft device-code session. Our Ghost family label covers website loaders with that code path.
An earlier delivery chain used a published site-builder page as the handoff. It presented a secured-document notice, a received date and a successful status. Its document button opened the encrypted page in a new tab.
The first response decrypts the real page
The compact loader carries an AES key, initialization vector and encrypted bytes. It imports the key with the Web Crypto API, decrypts the bytes with AES-GCM and replaces the current document with the plaintext.
An attached guard blocks the context menu and common developer-tools shortcuts. The decrypted page also checks browser dimensions, WebDriver and automation globals, language settings and IP organisation data. A blocked visit receives an expired-document decoy.
Another loader keeps the original URL, origin and fragment in session storage and patches top-level navigation while the decrypted page runs. This form preserves the lure's location as its scripts move between views.
A spreadsheet prompt starts the device flow
One decrypted page presents a blurred Excel workbook named as a financial summary. It tells the visitor to copy a short verification code and continue to Microsoft.
The page requests a new session from /api/device/start, displays the returned code and opens Microsoft's device sign-in. It then polls /api/device/status/ with the session ID. A completed response produces a success screen and redirects the browser. The visible workbook, code prompt and polling all come from the plaintext created after decryption.
What we see
| Month | New sites |
|---|---|
| September | 42 |
| October so far | 32 |
Among successful captures since 25 September, 0 of 41 Ghost sites ran WordPress.
Checking a Ghost page
Preserve both the initial response and the document created in memory. Look for:
- an AES key, initialization vector and ciphertext passed to
crypto.subtle.decrypt AES-GCMfollowed bydocument.open,document.writeanddocument.close- context-menu, keyboard, WebDriver or browser-dimension checks added after decryption
- a spreadsheet or secure-document prompt with a short Microsoft code
- requests to
/api/device/startand/api/device/status/ - original URL values stored in session storage while navigation is replaced
Remove the handoff, encrypted response and navigation loader. Review the site-builder, hosting, DNS and deployment accounts and rotate their credentials.