Author profile

Phillip Williams

Co-Founder & CTO, Legba

Phillip Williams leads architecture and product innovation at Legba. A veteran security engineer, he writes about browser threats, detection gaps, and the security architecture behind isolated browsing.

browser securityvulnerability researchsecurity architecturethreat detection

Published articles

Device Code Phishing: Why Your SOC Can't See the Attack Until It's Too Late

Device code phishing attacks like EvilTokens encrypt their payload so static URL analysis returns only ciphertext. Here's why your SOC can't see the attack until a browser executes it, and what to do about it.

Security Research · 2026-07-01

Adversary

Chrome Plugin

Published articles

Device Code Phishing: Why Your SOC Can't See the Attack Until It's Too Late