ScanMalware.com
Known malicious kitcriticalphishing

EvilTokens 'ghost' AES-GCM cloaking loader (YARA)

family: cloudflare_workers_phishing

Device-code phishing pages that hide their lure behind an inline loader: an empty placeholder plus a script that decrypts an embedded AES-GCM blob and writes the result into the page with document.write, so the phishing page is assembled in the browser and never appears in the HTML the server sends. The lures seen so far imitate Adobe Acrobat Sign and DocuSign document-signing pages.

Anchors

YARA ruleEvilTokens_Ghost_Loader

Provenance

Added: 2026-10-01 12:49
Matches only captures in which the loader itself is still present; once the loader has replaced the page, this rule cannot see it. Licence-key content gates that decrypt ordinary pages the same way are deliberately excluded.
References:

Sightings (49)

HostScanScriptMatchWhen
75t7-h6gu-8j8z.jessica-axismechanicalnc-com-s-account.workers.dev94b05f0a…https://75t7-h6gu-8j8z.jessica-axismechanicalnc-com-s-account.workers.dev/780647213c447739#htmlyara2026-10-01 09:21
docusign-9vs.jhon1213488-outlook-com-s-account.workers.dev7c4ad624…https://docusign-9vs.jhon1213488-outlook-com-s-account.workers.dev/c1f3f4af0aa29477#htmlyara2026-10-01 09:21
docusign-6gn.jhallman.workers.dev4aa2b3f4…https://docusign-6gn.jhallman.workers.dev/f05446c0edcc5693#htmlyara2026-10-01 09:21
docusign-glm.rough-rice-b41b.workers.dev0d56506f…https://docusign-glm.rough-rice-b41b.workers.dev/ed65c61f4c64380d#htmlyara2026-10-01 09:21
8gpv-tszw-jyrx.phil-heron-zoomdrain-com-s-account.workers.dev20805fcb…https://8gpv-tszw-jyrx.phil-heron-zoomdrain-com-s-account.workers.dev/0122c7727f3f9b87?email=example%2540domain.invalid#htmlyara2026-09-29 12:48
edge-edge-e7da3cbfb704853eb3.rentalescpade.workers.deve55ee437…https://edge-edge-e7da3cbfb704853eb3.rentalescpade.workers.dev/mNcsdTevCEOxM4puyIBwB2hTVcitynePtpNPbFyfA48?id=refds%3D0&_rt=1#htmlyara2026-09-22 12:46
3cud-je09-uln1.accounting-coralridgetowerssouth-com-s-account.workers.dev99a47823…https://3cud-je09-uln1.accounting-coralridgetowerssouth-com-s-account.workers.dev/90886#htmlyara2026-09-06 02:51
mhkx-1tsc-e9j4.xftjksrjk.workers.devfdf7f133…https://mhkx-1tsc-e9j4.xftjksrjk.workers.dev/#htmlyara2026-09-06 00:47
c60u-ufhn-0uxb.office-sanisolutions123-onmicrosoft-com-s-account.workers.deve896280c…https://c60u-ufhn-0uxb.office-sanisolutions123-onmicrosoft-com-s-account.workers.dev/07...#htmlyara2026-09-05 12:47
8yaz-k3zj-br05.cebsgroupsreceivables-ar-caesars-com-s-account.workers.devfaeaec6b…https://8yaz-k3zj-br05.cebsgroupsreceivables-ar-caesars-com-s-account.workers.dev/e29d2...#htmlyara2026-09-05 12:46
8yaz-k3zj-br05.cebsgroupsreceivables-ar-caesars-com-s-account.workers.devf8129afd…https://8yaz-k3zj-br05.cebsgroupsreceivables-ar-caesars-com-s-account.workers.dev/3fa9e...#htmlyara2026-09-05 12:46
y3ep-qkqx-9l1g.tnt-eb1.workers.dev619be967…https://y3ep-qkqx-9l1g.tnt-eb1.workers.dev/bdf8a5e98e99e897?email=corum1@4ad47ec496aa2d...#htmlyara2026-09-05 00:50
3cud-je09-uln1.accounting-coralridgetowerssouth-com-s-account.workers.dev0fce9a37…https://3cud-je09-uln1.accounting-coralridgetowerssouth-com-s-account.workers.dev/90886...#htmlyara2026-09-05 00:50
7wk0-c0co-0t2l.dturcotte-predictms-com-s-account.workers.deve4763c54…https://7wk0-c0co-0t2l.dturcotte-predictms-com-s-account.workers.dev/1a8578e3f506d45a?e...#htmlyara2026-09-05 00:50
fy5w-nxh6-g2ho.joliver-powershopscentralia-com-s-account.workers.dev06ed233b…https://fy5w-nxh6-g2ho.joliver-powershopscentralia-com-s-account.workers.dev/api/sessio...#htmlyara2026-09-05 00:48
0s8k-x5e9-qtge.aflores-rorealty-com-s-account.workers.devea55dffb…https://0s8k-x5e9-qtge.aflores-rorealty-com-s-account.workers.dev/598b16e94aacf51d?emai...#htmlyara2026-09-05 00:48
mn3w-fny9-jyay.dibafef289.workers.dev89bdd1d9…https://mn3w-fny9-jyay.dibafef289.workers.dev/3410deffe3b7ed9e?email=elynx@7c252ba54cf7c952cfe9e66cb56a0aefd4e7.net#htmlyara2026-09-05 00:48
gvhh-nc8x-hlli.kevartsbouvier-addisoncountypcc-org-s-account.workers.devb21d5eec…https://gvhh-nc8x-hlli.kevartsbouvier-addisoncountypcc-org-s-account.workers.dev/#htmlyara2026-08-29 12:54
b4pj-f4yx-2vn7.mark-mxzeilbeck-com-s-account.workers.dev9df56fe1…https://b4pj-f4yx-2vn7.mark-mxzeilbeck-com-s-account.workers.dev/#htmlyara2026-08-29 12:51
qg77-ljfe-7fsc.chris-titanbooths-com-s-account.workers.devaed0368b…https://qg77-ljfe-7fsc.chris-titanbooths-com-s-account.workers.dev/#htmlyara2026-08-29 12:47
zone-data-95529d585562.rentalescpade.workers.dev3b085a7d…https://zone-data-95529d585562.rentalescpade.workers.dev/AMVPyu-KLa0Lnu47Sl53DpOwD29Qeb-LwDPM30Xsp0U?ref=docks=0&_rt=1#htmlyara2026-08-27 13:48
zone-data-95529d585562.rentalescpade.workers.dev5516e619…https://zone-data-95529d585562.rentalescpade.workers.dev/vl95ZQovP-DqLnmIm_KL919mZ6CFZQj0mcAxeqnQRo0?ref=docks=0&_rt=1#htmlyara2026-08-27 13:48
zone-data-95529d585562.rentalescpade.workers.devb64d3765…https://zone-data-95529d585562.rentalescpade.workers.dev/XJvYQ6Ykob95VxbQ_QbZFVv81wRw0U5TuHwEi8yZm1g?ref=docks=0&_rt=1#htmlyara2026-08-27 12:55
zone-data-95529d585562.rentalescpade.workers.dev0d0a10cd…https://zone-data-95529d585562.rentalescpade.workers.dev/DKR_3aqmfk03mvOzujSQhBGvpLPq6bC46h-vXebgQ10?ref=docks=0&_rt=1#htmlyara2026-08-27 12:48
zone-data-95529d585562.rentalescpade.workers.dev7eeeef7c…https://zone-data-95529d585562.rentalescpade.workers.dev/Dj5HegFhowSSxYKJOlIwWWepaZrWEf8trEfGp0leAEg?ref=docks=0&_rt=1#htmlyara2026-08-27 12:48
adobeportal.appf1cbea68…http://adobeportal.app/#htmlyara2026-08-27 00:47
zone-data-95529d585562.rentalescpade.workers.dev448edc33…https://zone-data-95529d585562.rentalescpade.workers.dev/vQcwazwYQ-PmmXFG_z_Y_OG1bYRDbsIcvlcUxgC3YXo?ref=docks%3D0&_rt=1#htmlyara2026-08-27 00:47
docusign.login.adrpowersystem.com#htmle639357b…https://docusign.login.adrpowersystem.com#htmlyara2026-08-26 22:08
docusign.login.adrpowersystem.com2189bc99…https://docusign.login.adrpowersystem.com/#htmlyara2026-08-26 12:47
gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.dev90c81005…https://gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.dev/a61b5ed9623f1a6e?email=x#htmlyara2026-08-22 14:00
wjdo-u2dx-kfh0.workspace-trello-document-proton-me-s-account.workers.dev6161bfe3…https://wjdo-u2dx-kfh0.workspace-trello-document-proton-me-s-account.workers.dev/#htmlyara2026-08-19 01:02
adobe-yzz.ejkim-gsglobalusa-us-s-account.workers.dev07717c7b…https://adobe-yzz.ejkim-gsglobalusa-us-s-account.workers.dev/6ec1bcdcf1042f71/#htmlyara2026-07-30 00:51
nq19-o7h8-xixb.natalie-mstpartners-com-s-account.workers.dev874d02c7…https://nq19-o7h8-xixb.natalie-mstpartners-com-s-account.workers.dev/888d2a182e72a2f9?email=u#htmlyara2026-07-24 01:07
(inline)e32b662e…(inline)yara2026-07-16 00:49
project-details.acrobatsadobe.come32b662e…https://project-details.acrobatsadobe.com/#htmlyara2026-07-16 00:49
gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.devf71e0917…https://gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.dev/a61b5ed9623f1a6e?email=x#htmlyara2026-07-12 10:26
3cud-je09-uln1.accounting-coralridgetowerssouth-com-s-account.workers.deveda9ce74…https://3cud-je09-uln1.accounting-coralridgetowerssouth-com-s-account.workers.dev/1406c...#htmlyara2026-07-12 10:26
gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.devd3d7a45a…https://gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.dev/#htmlyara2026-07-12 10:26
gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.dev#htmlc7df0db2…https://gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.dev#htmlyara2026-07-12 10:26
3cud-je09-uln1.accounting-coralridgetowerssouth-com-s-account.workers.devc0e451ce…https://3cud-je09-uln1.accounting-coralridgetowerssouth-com-s-account.workers.dev/1406c#htmlyara2026-07-12 10:26
gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.devb2d60388…https://gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.dev/a61b5ed9623f1a6e?email=x#htmlyara2026-07-12 10:26
gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.devac840ab6…https://gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.dev/a61b5ed9623f1a6e?email=x#htmlyara2026-07-12 10:26
gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.dev98498dac…https://gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.dev/a61b5ed9623f1a6e?email=x#htmlyara2026-07-12 10:26
gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.dev83cfb7b8…https://gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.dev/#htmlyara2026-07-12 10:26
xmlf-ag9n-th11.mgeorgatos-netw1-com-s-account.workers.dev79b68ddb…https://xmlf-ag9n-th11.mgeorgatos-netw1-com-s-account.workers.dev/73603076837c4d77#htmlyara2026-07-12 10:26
gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.dev6027cc59…https://gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.dev/a61b5ed9623f1a6e?email=x#htmlyara2026-07-12 10:26
gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.dev12bbd5e6…https://gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.dev/#htmlyara2026-07-12 10:26
gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.dev0b787a3f…https://gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.dev/#htmlyara2026-07-12 10:26
gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.dev05d9af02…https://gcpu-f2ej-mr21.philip-turnkeytalk-com-s-account.workers.dev/#htmlyara2026-07-12 10:26