Reported by 1 outlet
ARToken PhaaS Exposes EvilTokens' Microsoft 365 Phishing Toolkit with Advanced BEC Capabilities
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
ARToken PhaaS Exposes EvilTokens' Microsoft 365 Phishing Toolkit with Advanced BEC Capabilities
bleepingcomputer.com · 102d ago · July 4th, 2026
Cisco Talos discovered a new phishing-as-a-service platform dubbed ARToken that operates as an affiliate of the EvilTokens phishing ecosystem. The React-based management panel exposed more than 80 API endpoints during an incident response investigation, revealing capabilities far beyond standard phishing kits.
ARToken enables attackers to steal Microsoft 365 authentication tokens, establish persistent access using Primary Refresh Tokens (PRTs), and access Outlook mailboxes, SharePoint sites, and OneDrive files. The platform deploys phishing infrastructure through Cloudflare Workers and automates business email compromise (BEC) operations — including multi-mailbox keyword monitoring, automatic content localization based on victim geography, and AI-assisted mailbox scoring for financial exposure.
The platform uses device code authentication phishing (Microsoft's OAuth 2.0 Device Authorization Grant workflow) that bypasses MFA by tricking victims into entering a legitimate Microsoft-issued code on Microsoft's official login page — causing Microsoft to issue authentication tokens directly to the attacker. Multiple technical similarities strongly tie ARToken to the EvilTokens platform documented by Sekoia in March. Push Security recently reported a 37-fold surge in device code phishing attacks over the past year, with at least 11 phishing kits now offering this technique.