ARToken: Business Email Compromise-as-a-Service Platform Targeting Microsoft 365 (Cisco Talos / EvilTokens Affiliate)

ARToken: Business Email Compromise-as-a-Service Platform (TL-2026-1036), also tracked as ARToken, is a high-severity phishing campaign, first published 2026-07-01. It is attributed to EvilTokens (Russia) with low confidence, affects Microsoft Microsoft 365 / Entra ID (Azure AD) OAuth 2.0 Device, maps to 31 MITRE ATT&CK techniques (T1020, T1027, T1036), and is covered by 9 detection rules and 25 indicators of compromise.

Key facts for TL-2026-1036

Threat ID
TL-2026-1036
Also known as
ARToken, EvilTokens affiliate panel
Severity
HIGH
Status
ACTIVE
Category
PHISHING
First published
2026-07-01
Last reviewed
2026-07-01
Attribution
EvilTokens
Attribution confidence
LOW
Nation-state nexus
Russia
Motivation
FINANCIAL
Target sectors
finance, human resources, logistics, accounts-payable, life sciences, public sector, construction, non-profit organisation, real estate, manufacturing, financial services, health
Target regions
united states of america, canada, australia, new zealand, germany, france, india, switzerland, united arab emirates
Detection rules
9
Indicators of compromise
25

Malware and tooling in ARToken: Business Email Compromise-as-a-Service Platform

Malware and tooling: ARToken, EvilTokens, Kali365, ARTBrowser

Cisco Talos disclosed ARToken, a fully-featured Phishing-as-a-Service (PhaaS) operator panel that shares infrastructure, API contracts, and operational patterns with the EvilTokens platform. ARToken exposes 80+ API endpoints for OAuth 2.0 device-code phishing, Primary Refresh Token (PRT) persistence, inbox rule manipulation, SharePoint exfiltration, and shared-access-link abuse against Microsoft 365 tenants, wrapped in a seven-layer client-side anti-analysis system.

How ARToken: Business Email Compromise-as-a-Service Platform works

On July 1, 2026, Cisco Talos published research on ARToken, an affiliate operator panel of the EvilTokens Phishing-as-a-Service (PhaaS) operation. Where EvilTokens (first documented by Sekoia in March 2026 and corroborated by Microsoft in April 2026) provided a turnkey Microsoft device-code phishing kit for OAuth 2.0 Device Authorization Grant (RFC 8628) abuse, ARToken is a complete downstream BEC operations environment built on top of stolen tokens. The React-based ARToken dashboard exposes over 80 documented API endpoints covering device-code initiation (/api/device/start, hardcoded operator UUID 84eb384d-cd3e-4c90-a283-c960ce557913), Primary Refresh Token lifecycle management (/prt/setup, /prt/refresh, /prt/renew, /prt/reacquire, /prt/cookie), full Outlook inbox read/send with BCC batching, inbox rule creation for forwarding and evidence suppression, SharePoint/OneDrive browse-upload-download-permission operations, cross-account keyword monitoring ('Box Monitor'), token import from external sources, and automated Cloudflare Worker phishing-page deployment. A standalone Windows desktop application, ARTBrowser, allows operators to browse hijacked sessions directly. The kit layers a seven-stage client-side anti-analysis system (headless-browser User-Agent blocking, navigator.webdriver checks, browser fingerprinting, window-dimension analysis, mouse/touch interaction telemetry, an 800ms timing gate, and non-linear movement-pattern validation) atop XOR-encrypted payloads (16-byte key), a materially more sophisticated evasion approach than the server-side X-Antibot-Token (SHA-256 of secret + Unix timestamp + '_antibot', 5-minute validity window) used by the base EvilTokens kit. Operators lure accounts-payable, finance, HR, and logistics staff at real vendor relationships with outstanding-invoice and urgency-themed emails, in several documented cases spoofing legitimate vendor contacts to reach real AP recipients at victim organizations including public-sector and life-sciences entities. Phishing infrastructure is fronted through Cloudflare Workers (observed patterns include clear90489058903-document.workers[.]dev and UUID-prefixed {uuid}-docviewer.workers[.]dev, as well as the wider EvilTokens adobe-[a-z0-9]{3}.[a-z0-9-]{3,}-s-account.workers.dev pattern), with a dedicated management panel (dashboard-bl.pamconj[.]com) and C2 API (spx.pamconj[.]com). EvilTokens itself has been tracked hitting 340+ organizations across the US, Canada, Australia, New Zealand, Germany, France, India, Switzerland, and the UAE since first detection on February 19, 2026, using multi-hop redirect chains that abuse Railway.com-hosted infrastructure, Vercel, compromised legitimate sites, and even redirects through security-vendor domains (Cisco, Trend Micro, Mimecast) to evade reputation-based filtering. Threat activity has been loosely associated with Russia-aligned clusters including Storm-2372, APT29, UTA0304, UTA0307, and UNK_AcademicFlare, alongside a related independent kit, Kali365, flagged by the FBI IC3 in a May 21, 2026 PSA (I-052126-PSA) using the identical device-code phishing mechanic. The EvilTokens/ARToken ecosystem is commercialized: EvilTokens core access sells for $1,500 one-time plus $500/month, a standalone Portal Browser for $500 lifetime, and anti-bot page add-ons distributed via a dedicated Telegram bot with 24/7 operator support. Because the initial authentication step occurs on Microsoft's own legitimate devicelogin page, the technique evades most conventional credential-phishing detections, and captured Primary Refresh Tokens persist attacker access across victim password resets, requiring explicit device-code-flow conditional access blocks and refresh-token revocation for remediation.

MITRE ATT&CK techniques used in TL-2026-1036

Exfiltration

T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1497.001 System Checks

Command and Control

T1071.001 Web Protocols; T1102 Web Service

Initial Access

T1078.004 Cloud Accounts; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link

Discovery

T1087.004 Cloud Account; T1538 Cloud Service Dashboard

Persistence

T1098.001 Additional Cloud Credentials; T1098.005 Device Registration

Collection

T1114.002 Remote Email Collection; T1119 Automated Collection; T1530 Data from Cloud Storage

collection

T1114.003 Email Forwarding Rule

Credential Access

T1187 Forced Authentication; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1621 Multi-Factor Authentication Request Generation

Execution

T1204.001 Malicious Link

Impact

T1531 Account Access Removal; T1657 Financial Theft

lateral-movement

T1550.001 Application Access Token

Resource Development

T1583.006 Web Services; T1587.001 Malware; T1588.002 Tool

Reconnaissance

T1589.002 Email Addresses

defense-impairment

T1685.002 Disable or Modify Cloud Log

Affected products and versions in ARToken: Business Email Compromise-as-a-Service Platform

  • Microsoft — Microsoft 365 / Entra ID (Azure AD) OAuth 2.0 Device Authorization Grant
    Vulnerable versions: all tenants with device code flow enabled
    Fixed in: tenants with device code flow disabled via Conditional Access
  • Microsoft — SharePoint Online / OneDrive
    Vulnerable versions: accessible via stolen PRT/session tokens
    Fixed in: N/A - mitigated via token revocation and CA policy
  • Microsoft — Outlook Web Access (OWA)
    Vulnerable versions: sessions established via stolen refresh/PRT tokens
    Fixed in: N/A - mitigated via session/token revocation

Remediation for ARToken: Business Email Compromise-as-a-Service Platform

Immediate actions

  • Block Microsoft OAuth 2.0 Device Authorization Grant flow via Conditional Access policies, with narrow exceptions for confirmed legitimate device-code use cases
  • Audit and revoke all active refresh tokens and Primary Refresh Tokens for suspected compromised accounts
  • Review and remove unauthorized Outlook inbox rules (forwarding, auto-delete) created without user knowledge
  • Block known ARToken/EvilTokens infrastructure at email gateway and web proxy: dashboard-bl.pamconj[.]com, spx.pamconj[.]com, authdocspro[.]com, backdoor-hub[.]com, notificationsmanagersec[.]com, framebound[.]cloud
  • Alert accounts-payable / finance / HR staff to outstanding-invoice and device-code social engineering lures

Workarounds

  • Disable Microsoft device code authentication entirely at the tenant level where not operationally required
  • Require re-authentication and step-up verification for high-risk actions (inbox rule creation, mailbox forwarding, SharePoint sharing link creation)

Longer-term hardening

  • Deploy Conditional Access policies restricting device-code sign-in to managed/compliant devices only
  • Implement phishing-resistant MFA (FIDO2/WebAuthn) to reduce reliance on OTP/device-code-susceptible flows
  • Enable continuous access evaluation (CAE) to shorten token validity windows
  • Monitor for anomalous PRT reacquisition, OWA session cookie generation, and SharePoint bulk-download activity
  • Deploy detection for Cloudflare Workers-hosted phishing domains matching adobe/document/docviewer naming patterns

Weaknesses (CWE) in ARToken: Business Email Compromise-as-a-Service Platform

CWE-287, CWE-294, CWE-346

Timeline of ARToken: Business Email Compromise-as-a-Service Platform

  • EvilTokens device-code phishing campaign first detected in the wild, per HackerNews/Push Security reporting; earliest samples circulating since mid-February 2026 per Sekoia.
  • Reporting indicates 340+ organizations across the US, Canada, Australia, New Zealand, and Germany (later expanded to France, India, Switzerland, UAE) compromised via the campaign, with attribution loosely tied to Storm-2372, APT29, UTA0304, UTA0307, and UNK_AcademicFlare.
  • Sekoia's Threat Detection & Research team publishes Part 1 of its EvilTokens analysis, documenting the device-code phishing kit, X-Antibot-Token mechanism, and initial infrastructure (500+ Cloudflare Workers domains, 1,000+ total infrastructure domains as of March 23, 2026).
  • Microsoft publishes research confirming and expanding on the AI-enabled device-code phishing campaign; Sekoia publishes Part 2 with additional operational details.
  • Sample ARToken phishing emails observed being sent at approximately 4-minute intervals, indicating automated bulk-send tooling.
  • FBI IC3 issues Public Service Announcement I-052126-PSA on the related Kali365 phishing-as-a-service kit, which uses the identical OAuth device-code mechanism to bypass MFA on Microsoft 365 accounts.
  • CyberScoop publishes coverage of the Talos ARToken research, including quotes from Talos researcher Michael Kelley describing the kit as 'more fleshed out and polished than previous instances.'
  • Cisco Talos publishes detailed research on ARToken, an EvilTokens affiliate operator panel, revealing its 80+ API endpoints, seven-layer anti-analysis system, PRT persistence tooling, and full BEC operations capability (inbox rule manipulation, SharePoint exfiltration, shared access links).

Sources cited for ARToken: Business Email Compromise-as-a-Service Platform

Threats related to ARToken: Business Email Compromise-as-a-Service Platform

Detection coverage for TL-2026-1036

As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1036 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats