Huntress Highlights Threats Using Legitimate Cloud Infrastructure for Phishing-as-a-Service

According to a recent LinkedIn post from Huntress, the company is drawing attention to the use of legitimate platform-as-a-service infrastructure by cybercriminals. The post describes how a threat actor dubbed EvilTokens allegedly used Railway to run a phishing-as-a-service operation with AI-generated, role-specific lures and automated token harvesting.

The post also points to an upcoming live session featuring Huntress representative Casey S. and Microsoft’s Sherrod DeGrippo, positioned as a deep dive into the campaign and defender strategies. For investors, this content suggests Huntress is focusing on emerging attack patterns that abuse trusted cloud platforms, potentially reinforcing its relevance in identity-focused and cloud security markets.

By aligning with a senior executive from Microsoft Threat Intelligence, Huntress appears to be emphasizing collaboration with larger ecosystem players and its presence in advanced threat research discussions. Such positioning may support the firm’s brand as a specialist in detecting and countering sophisticated cybercrime operations, which could be important for customer acquisition and retention in the competitive managed security and threat-intelligence landscape.

The emphasis on phishing-as-a-service and token-based compromise also indicates continued demand for solutions that protect identity and cloud access rather than just endpoints. If Huntress can translate this thought leadership into product capabilities or services that address these specific attack methods, the heightened visibility around these threats could translate into expanded security budgets and upsell opportunities over time.