New Ghost Phishing Wave Is Breaking Traditional Email Security

A recent EvilTokens campaign targeting businesses across the US and Europe is exposing a new email security blind spot. This “ghost phishing” technique keeps the malicious page hidden until it decrypts and comes to life inside the victim’s browser. For security leaders, the risk is clear: traditional URL checks may miss the attack while Microsoft 365 access, sensitive data, and response time

The article describes a "ghost phishing" campaign (EvilTokens) that uses multi-stage, browser-side decryption to keep malicious Microsoft 365 credential-harvesting pages hidden until they render inside the victim’s browser, bypassing traditional URL inspection and email security controls.[2] This is a SaaS security blind spot for Microsoft 365, where attackers exploit trusted infrastructure and advanced evasion to gain access to accounts and sensitive data.[1][3] From a RealGround perspective, these techniques directly impact AI-integrated SaaS environments (e.g., email security, M365 Copilot, and automated SOC tools), meaning AI-driven filters and agents may fail if they rely only on static URL or payload checks. Organizations should apply Continuous AI Red Teaming to test AI email/security workflows against similar multi-stage, client-side-decrypted phishing patterns and strengthen policies around SaaS access, conditional access, and MFA to limit blast radius when such evasion succeeds.[2][4]