EvilTokens conceals its phishing workflow behind browser-side AES-GCM decryption, making static URL analysis insufficient for detecting Microsoft 365 device code attacks. This article shows how browser-level inspection in ANY.RUN reveals decrypted pages, traces device-code phishing activity, uncovers related infrastructure through threat intelligence, and helps SOC teams investigate, detect, and contain attacks faster.