# Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure

EvilTokens PhaaS used Railway-hosted infrastructure to run OAuth device code phishing against 344 Microsoft 365 orgs, harvesting refresh tokens valid up to 90 days.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft
- Analysis by: Huntress
- Disclosed: 2026-03-23
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/railway-paas-m365-token-replay-campaign
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-railway-paas-m365-token-replay-campaign
- Tags: area:cloud domain:cloud impact:ato impact:data-leak kind:incident platform:threat-intel sev:high tech:azure tech:oauth technique:recon vuln:account-takeover vuln:auth-bypass

**Target:** Microsoft Entra ID OAuth device authorization flow (microsoft.com/devicelogin)
**Root cause:** OAuth device code flow lets any client generate a code and have a victim authorize it on the legitimate Microsoft endpoint; the attacker's backend then receives access and refresh tokens without a password or MFA defeat.
**Steps:**
1. Attacker generates a device code via the OAuth device authorization flow and hosts a landing page on Railway/Cloudflare workers.dev that renders the code with a pretext (e.g. 'read files').
2. Lure email is wrapped in security-vendor URL rewriters (`secure-web.cisco.com`, `cas5-0-urlprotect.trendmicro.com`, `url.us.m.mimecastprotect.com`) and multi-hop redirects through compromised sites to reach the landing page.
3. Victim clicks 'Continue to Microsoft', a pop-up opens the legitimate `microsoft.com/devicelogin` endpoint, and enters the displayed 8-character code.
4. Victim authenticates with username, password, and MFA; the attacker's backend receives access + refresh tokens.
5. Attacker replays tokens from Railway egress IPs (`162.220.232.0/22`, `162.220.234.0/22`) rotating realistic user agents, including `BAV2ROPC` for scheduled refresh.
**How found:** Huntress SOC spotted a wave of anomalous authentication events across dozens of orgs on February 19, 2026, all originating from a narrow Railway IP block with `cmsi` session type (87.4%), indicating device code phishing; UA analysis revealed synthetic iPhone `Version/26` strings and programmatic BAV2ROPC scheduling.
**Exploitation:** Tokens are replayed from Railway-hosted containers whose clean IP reputation avoids Microsoft Identity Protection risk scoring; refresh tokens persist up to 90 days and survive password resets, enabling BEC/wire fraud across 344 orgs in US, CA, AU, NZ, DE.
**Escalation:** Refresh token persistence (up to 90 days) plus scheduled BAV2ROPC token refresh twice daily (11:00 AM and 8:00 PM) for high-value targets; EvilTokens PhaaS sold the capability with AI-tailored lures and open-redirect credential capture.
**Insight:** Device code flow logins from cloud PaaS egress IPs with `cmsi` session type are high-fidelity compromise signals; also key on impossible UA combos like iPhone OS 18_7 with Safari Version/26.3, and on BAV2ROPC UAs at fixed twice-daily times indicating automated refresh persistence.

## Proof of concept (copied exactly from the original report)

**Sentinel KQL hunt for Railway IP logins**

```
SigninLogs

 | where IPAddress startswith "162.220.234." or IPAddress startswith "162.220.232."

| where ResultType == 0

 | project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress,

           AuthenticationRequirement,
 ConditionalAccessStatus

| order by TimeGenerated desc
```

**KQL hunt for BAV2ROPC token refresh**

```
AADNonInteractiveUserSignInLogs

 | where IPAddress startswith "162.220.232." or IPAddress startswith "162.220.234."

| where UserAgent contains "BAV2ROPC"

 | project TimeGenerated, UserPrincipalName, ResourceDisplayName, IPAddress
```