Ghost Phishing: The New Threat to Las Vegas Businesses

What Is “Ghost Phishing,” and Why Does It Matter to Las Vegas Businesses?

Security researchers are tracking a new wave of business email compromise attacks built around a technique nicknamed “ghost phishing.” The campaign, identified by threat intelligence firm ANY.RUN and reported by The Hacker News in July 2026, uses a malware kit called EvilTokens to hijack Microsoft 365 accounts without ever stealing a password directly.

Here is what makes it dangerous for small and mid-sized Las Vegas businesses specifically: the malicious page does not exist until it is already inside your employee’s browser. The email itself passes standard link and attachment scans because the phishing content is encrypted. It only decrypts and renders after the browser opens it — which means the security tools most local businesses depend on, from basic spam filters to network-level URL checks, never see the actual attack.

How the Attack Actually Works

Ghost phishing does not rely on a fake login page that looks slightly off. It uses Microsoft Device Code Phishing, a legitimate Microsoft sign-in flow normally used to log in to smart TVs, printers, and other devices without a keyboard. Attackers trick an employee into entering a real, attacker-generated device code on a real Microsoft login screen — and the employee unknowingly authorizes the attacker’s session themselves.

• The lure: An email disguised as a meeting invite, document share, or vendor notification directs the employee to a link.
• The hidden payload: The destination page’s HTML is encrypted with AES-GCM encryption, so it looks blank or harmless to automated scanners and email security gateways.
• The render: Once opened in a real browser, the page decrypts and displays a legitimate-looking Microsoft device code prompt.
• The handoff: The employee enters the code, unintentionally granting the attacker a valid, authenticated session — no stolen password required.
• The payoff: The attacker now has standing access to email, files, and connected cloud apps until someone notices and revokes the session.

Because no password is stolen and no malicious file is downloaded, this attack slides past the two things most Las Vegas small businesses check for. That is exactly why the FBI’s Internet Crime Complaint Center (IC3) reported $3.046 billion in business email compromise losses in 2025 alone — making BEC the single most financially destructive attack category aimed at businesses in the country.

This is also why annual phishing-awareness training, on its own, is no longer enough. Most employee training still centers on spotting a fake domain or a misspelled sender name. Ghost phishing sails past both, because the page an employee sees really is served from Microsoft’s own infrastructure right up until the moment it decrypts. Las Vegas businesses that treat security awareness as a once-a-year checkbox rather than one layer among several are the ones most exposed to this technique.

What’s at Stake for Las Vegas Businesses

Clark County’s economy runs on a dense web of vendors, contractors, and service providers who all trust each other’s email. A single compromised Microsoft 365 account does not stay contained to one company — it becomes a launching pad for fraudulent invoices, redirected payments, and follow-on attacks against every partner in that inbox’s contact list. That makes the following Las Vegas sectors especially exposed right now:

• ⚠Professional services and law firms handling client trust funds, contracts, and confidential case data through Microsoft 365
• ⚠Financial services firms and credit unions where a compromised inbox can trigger fraudulent wire transfer requests
• ⚠Henderson-area manufacturers and industrial suppliers connected to hospitality and gaming supply chains
• ⚠Hospitality and gaming vendors whose compromised accounts can be used to pivot into partner networks
• ⚠Any business that relies on Microsoft 365 without phishing-resistant multi-factor authentication in place

Closing the Gaps: Three Fixes Every Las Vegas Business Needs

Defending Las Vegas with CMIT Solutions

Business email compromise techniques like ghost phishing evolve faster than most in-house IT teams can track alone. CMIT Solutions of Las Vegas monitors emerging threats like the EvilTokens campaign and builds layered defenses — phishing-resistant MFA, conditional access policies, and 24/7 monitoring — specifically for the Clark County businesses that gaming, hospitality, healthcare, legal, and manufacturing clients depend on every day.