EvilTokens Is Still Live: Three Months On, the PhaaS Platform Has Spread

Adverse Trace OSINT Assessment · 2026-06-25

Summary

• The MailVault C2 platform at techroboticslabmade.com is live and serving its marketing page, including a "Tenant Login" admin panel requiring an access key.
• Three self-hosted PHP backends — macmamo.com, smstltle.net, and notificationsmanagersec.com — are all serving "Microsoft 365 - Voicemail" lure pages from the same Cloudzy Tampa IP (216.126.227.101).
• The compromised gate site bibf.ac.bw hosted 30+ "Identity Verification" gate pages from 18–26 March 2026.
• A new compromised gate site, bonlait.com, is serving the same kit template and was scanned 18 times between 18 June and 25 June 2026, including on the day this report was written.
• Six additional compromised websites not in the original IOC list are serving the same gate-page template: advanced-leadership.com, nycelitechauffeur.com, stacoelectrics.com, mgj.social, bonlait.com, and hjkzd-oaaaa-aaaad-qf7za-cai.icp0.io.
• At least 20 distinct Cloudflare Worker tenants are operating EvilTokens lure pages, identifiable by the -s-account.workers.dev subdomain pattern.
• A Cloudflare Worker at clouddocs.salv-976.workers.dev mimics Microsoft SSO error pages, with a hex-encoded state parameter decoding to [email protected]. Cloudflare itself flagged it as "Suspected Phishing."
• The same Cloudzy IP (216.126.227.101) hosts zerobotv9 IoT botnet malware under /mamakmukekkontol/ — multi-arch binaries (arm5, arm6, arm7, mips, x86, x86_64, spc, arc, m68k, sh4, ppc).

Methodology

All data was collected from public, indexed sources:

1. SearXNG metasearch (Adverse Trace internal) — broad queries for the kit markers // <-- REPLACE WITH YOUR ACTUAL DOMAIN and versioned v2.4.0, branded "Identity Verification". The exact comment-form string did not surface in indexed results; search engines strip // and <-- as punctuation. The phrase body appeared only in the Abnormal.ai source article, not on any live phishing page — consistent with the kit's AES-256-GCM encrypted payload and JavaScript-gated bot filter, both of which prevent search-engine crawlers from reaching the gate-page DOM.
2. URLScan.io — targeted queries against the named IOCs and kit markers. URLScan indexes submitted scans of URLs, including page titles, server headers, IP addresses, ASN data, and screenshots. This is the highest-yield source for ephemeral phishing infrastructure because scans are submitted by researchers, security products, and automated crawlers that execute JavaScript.
3. Certificate Transparency (crt.sh) — no certificates returned for any domain. Cloudflare Workers use Cloudflare-managed certificates that do not appear in CT logs under the worker subdomain name.
4. Wayback Machine — no historical captures for any IOC domain.
5. IP pivot on URLScan — querying all scans from the Cloudzy IP (216.126.227.101) revealed two additional EvilTokens backend domains (smstltle.net, notificationsmanagersec.com) and zerobotv9 IoT botnet malware hosting.
6. Vision model analysis — screenshots downloaded from URLScan.io were analysed using a local Qwen3.6-35B vision model to extract UI text, branding, and social-engineering content.

1. MailVault C2 Platform — techroboticslabmade.com

The central command-and-control platform, branded "MailVault — Enterprise Email Management," remains live. The marketing page advertises features that are unambiguous about the platform's criminal purpose.

Screenshot: MailVault Marketing Page

Screenshot: MailVault Admin Panel ("Tenant Login")

Infrastructure Details

Marketing Copy (from screenshot analysis)

Tenant paths observed in URLScan data: /t/wxeequrhsrvn/, /t/pn9lx1nemx7g/, /t/xednndsnb5xd/, /t/vxwf13h3f7r8/. The /t/{tenant_id}/ pattern matches the Abnormal report's description of multi-tenant SaaS isolation, where each customer (identified by a Telegram handle) receives an isolated environment.

2. Self-Hosted PHP Backends — Three Domains on One Cloudzy IP

An IP pivot on URLScan.io for the Cloudzy Tampa IP (216.126.227.101) from the original IOC list revealed that three domains are serving the "Microsoft 365 - Voicemail" lure from the same server — not just macmamo.com as documented in the Abnormal report.

3. Compromised Gate Sites

3a. bibf.ac.bw (Botswana Institute of Banking & Finance) — Active 18–26 March 2026

The legitimate site (https://bibf.ac.bw/) serves the organisation's real content. Gate pages were deployed at paths following the pattern:

https://bibf.ac.bw/{Day}-{uuid}-{DictionaryWord}{hex}{F|G}.html

Observed examples:

• Monday-ea8c0bf5-9dde-41ea-MORN9927-709582e21fafF.html
• Tuesday-f1047615-fa57-4e76-a890-85cef9a06757F.html
• Tuesday-e92e0a92-5522-MARCH457c-8f13-2b90fb440f57F.html
• Tuesday-8f01879c-78a9ALL-4013-903a-1674a75941adF.html

All gate pages returned the title Identity Verification. The day-prefix (Monday/Tuesday/Thursday) and dictionary-word (Dactyliography, Dactyliology, Dactyliomancy, Dactylonomy) pattern is consistent with an automated template generator that creates unique URLs per phishing run.

Screenshot: bibf.ac.bw Gate Page

3b. bonlait.com — Active 18 June to 25 June 2026 (today) LIVE

Not named in the Abnormal IOC list. bonlait.com is a 3,596-day-old legitimate domain that has been compromised and is serving the same gate-page template. The URL pattern is identical to bibf.ac.bw.

Screenshot: bonlait.com Gate Page

3c. Additional Compromised Gate Sites

4. Cloudflare Worker Tenants — 20+ Active Operators

The EvilTokens kit's signature is the -s-account.workers.dev subdomain pattern, where compromised business domain names are embedded in the worker subdomain. URLScan data confirms at least 20 distinct operator tenants:

Four lure variants are observed in the wild:

1. DocuSign - Review Document
2. Microsoft 365 - Voicemail
3. A.C.H Payment Processing Team
4. DocuSign | Action Required: Identity Verification

The compromised business domains embedded in the worker subdomains span law firms (jenccrosslaw, turnkeytalk, foundrymortgagecapital), dental practices (dentalstore, ctbakery), accounting firms (coralridgetowerssouth, hpepaper), insurance companies (smithinsurancellc), energy services (tesenergyservices), plumbing (zoomdrain), automotive (onixautomotive), sleep clinics (sleepbetteraustin), and academic institutions (dfci-harvard).

Screenshot: Bot-Filter Interstitial (nathan-5c9 workers.dev)

5. salv-976 Worker: Microsoft SSO Impersonation

A Cloudflare Worker at clouddocs.salv-976.workers.dev serves a page mimicking a Microsoft SSO error:

https://clouddocs.salv-976.workers.dev/?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=6d796f756e67407369676d617265702e636f6d

The hex-encoded state parameter decodes to:

[email protected]

This is a target email address embedded in the URL — consistent with the EvilTokens kit's pattern of passing the target's email through the Cloudflare Worker for tracking. The worker at clouddoc.salv-976.workers.dev (without the "s") was flagged by Cloudflare itself as "Suspected Phishing" across multiple scans from 2026-06-07 onwards.

6. zerobotv9: IoT Botnet on the Same Infrastructure

The IP pivot on the Cloudzy IP (216.126.227.101) revealed that the same server hosts zerobotv9 IoT botnet malware under the path /mamakmukekkontol/. Multi-arch binaries are available:

7. Screenshot Evidence — Detailed Analysis

MailVault C2 Marketing Page

The techroboticslabmade.com root page renders as a professional SaaS marketing page. Key elements confirmed from screenshot analysis:

• Logo: Purple square with white envelope icon, text "MailVault" in purple-to-white gradient
• Navigation: "Features" link, "Tenant Login →" button
• Status badge: "Platform Status: Online" (green dot)
• Headline: "Enterprise Email Management Platform" with "Email Management" in purple-to-pink gradient
• Sub-headline: "Secure, isolated tenant environments with advanced monitoring, automated workflows, and real-time analytics."
• Stats bar: "99.9% Uptime SLA" | "256-bit Encryption" | "24/7 Monitoring"
• Feature cards: Tenant Isolation, Real-time Dashboard, Auto-Refresh, Landing Pages (with "bot detection"), Telegram Alerts (for "captures"), Multi-Scope Auth

MailVault Admin Panel

The admin panel at /t/{tenant_id}/admin renders as:

• Icon: Yellow waving hand emoji (&wave;&wave;&wave;)
• Heading: "Welcome back"
• Subtext: "Enter your access key to get started"
• Input field: Padlock icon, placeholder "Paste your access key"
• Button: "Continue →" (solid purple)
• Footer link: "Lost your key? Contact support"

Gate Page — bonlait.com (2026-06-25)

• Blue header banner with yellow padlock+key icon
• Heading: "Verify You Are Human"
• Sub-heading: "Secure · Private · One-click"
• Instruction: "Enter your email address to verify your identity and continue."
• Email input field: label "Email Address", placeholder "[email protected]"
• Button: "Continue" (full-width, grey-blue)
• "Important Notice": "We verify real users to keep our service safe. Your email is used only for this access check and is not stored permanently."
• Footer: "© 2026 Identity Assurance"
• Badge: "Privacy Protected" (shield icon)

Gate Page — bibf.ac.bw (2026-03-26)

• Blue header: "Verify You Are Human" with yellow padlock icon
• Instruction: "Please enter your email address to continue."
• Email input: label "Email Address", placeholder "[email protected]"
• Button: "Continue"
• "IMPORTANT NOTICE & DISCLAIMER" section with three subsections:
  • "Identity verification scope": "strictly for identity confirmation, account security, and authorized communication"
  • "Data processing & transparency": references GDPR Article 6 and CCPA §1798.100. States: "Your email address, IP address, timestamp, and browser metadata are collected to prevent fraud, ensure security, and meet legal obligations"
  • "Your rights & control": (text cut off at bottom of screenshot)

Bot-Filter Interstitial — nathan-5c9 workers.dev (2026-06-24)

• Horizontal rounded rectangle with white background and purple border
• Checkbox icon (left)
• Text: "Access verification" (bold) / "Tap to proceed" (smaller)
• Shield+checkmark icon (right, purple)

This interstitial mimics Cloudflare's "Verify you are human" challenge UI. It is the JavaScript gate that traps non-JS crawlers — sandboxes and search-engine bots without JavaScript execution never proceed past this page, which is why no live EvilTokens gate page appears in Google, Bing, or DuckDuckGo's indexed results.

8. What This Means

1. The Abnormal IOCs are still valid. Every named domain, IP, and infrastructure pattern from the 3 April writeup is confirmed live or was live within the past 90 days.
2. The kit has spread. At least 7 new compromised domains are serving the same gate-page template. None appear in the original IOC list.
3. The operator is rotating backend domains. Three domains (macmamo.com, smstltle.net, notificationsmanagersec.com) all serve the same voicemail lure from the same Cloudzy IP.
4. Multiple operators are active concurrently. The -s-account.workers.dev pattern appears across 20+ distinct Cloudflare Worker tenants.
5. The infrastructure is multi-criminal-use. The same Cloudzy VPS hosts both EvilTokens phishing infrastructure and zerobotv9 IoT botnet malware.
6. The bot filter and encrypted payload remain effective against search engines. Google, Bing, and DuckDuckGo have not indexed any live EvilTokens gate page. URLScan.io remains the most effective public source for tracking this infrastructure.
7. The kit's social engineering is sophisticated. Gate pages include fake GDPR/CCPA compliance text, fabricated "Identity Assurance" branding, and "Privacy Protected" badges. The bot-filter interstitial mimics Cloudflare's challenge UI.

9. Defensive Recommendations

1. Block Railway CIDRs (162.220.232.0/22, 162.220.234.0/22) via Conditional Access Named Locations. The MailVault C2 and token replay infrastructure operate from Railway.
2. Block the Cloudzy IP 216.126.227.101 at the network layer. This IP hosts three EvilTokens backend domains and zerobotv9 IoT botnet malware.
3. Disable Device Code authentication via Conditional Access unless explicitly required for headless devices.
4. Enable Continuous Access Evaluation (CAE) to reduce token revocation latency to near-real-time.
5. Monitor for the kit's URL patterns:
   • /{Day}-{uuid}-{DictWord}{hex}{F|G}.html on compromised CMS sites
   • *-s-account.workers.dev subdomains on Cloudflare
   • Page titles: Identity Verification, DocuSign - Review Document, Microsoft 365 - Voicemail, A.C.H Payment Processing Team, Verify You Are Human
6. Monitor URLScan.io for the kit markers. The query page.title:"Identity Verification" returns current gate pages. The query page.title:"DocuSign - Review Document" filtered to workers.dev domains returns current Cloudflare Worker tenants.
7. Block the three backend domains at the DNS/proxy layer: macmamo.com, smstltle.net, notificationsmanagersec.com.

10. Indicators of Compromise (Updated 2026-06-25)

Domains

IP Addresses

Cloudflare Worker Pattern

Subdomains matching *-s-account.workers.dev are EvilTokens operator tenants. The pattern {random-3-4-char-groups}.{compromised-business-domain-with-dashes-replaced}-s-account.workers.dev is the kit's signature.

Kit Markers

zerobotv9 Malware Paths