If you're battling phishing detections through CSS canary tokens, make sure to add these entries into your Evilginx MS365 phishlet to evade the detection. This will block requests to canaries hosted via cloudfront[.]net.