ARToken: Business Email Compromise-as-a-Service Platform Targeting Microsoft 365 (Cisco Talos / EvilTokens Affiliate)
ARToken: Business Email Compromise-as-a-Service Platform (TL-2026-1036), also tracked as ARToken, is a high-severity phishing campaign, first published 2026-07-01. It is attributed to EvilTokens (Russia) with low confidence, affects Microsoft Microsoft 365 / Entra ID (Azure AD) OAuth 2.0 Device, maps to 31 MITRE ATT&CK techniques (T1020, T1027, T1036), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-1036
- Threat ID
- TL-2026-1036
- Also known as
- ARToken, EvilTokens affiliate panel
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-07-01
- Last reviewed
- 2026-07-01
- Attribution
- EvilTokens
- Attribution confidence
- LOW
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- finance, human resources, logistics, accounts-payable, life sciences, public sector, construction, non-profit organisation, real estate, manufacturing, financial services, health
- Target regions
- united states of america, canada, australia, new zealand, germany, france, india, switzerland, united arab emirates
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in ARToken: Business Email Compromise-as-a-Service Platform
Malware and tooling: ARToken, EvilTokens, Kali365, ARTBrowser
Cisco Talos disclosed ARToken, a fully-featured Phishing-as-a-Service (PhaaS) operator panel that shares infrastructure, API contracts, and operational patterns with the EvilTokens platform. ARToken exposes 80+ API endpoints for OAuth 2.0 device-code phishing, Primary Refresh Token (PRT) persistence, inbox rule manipulation, SharePoint exfiltration, and shared-access-link abuse against Microsoft 365 tenants, wrapped in a seven-layer client-side anti-analysis system.
How ARToken: Business Email Compromise-as-a-Service Platform works
On July 1, 2026, Cisco Talos published research on ARToken, an affiliate operator panel of the EvilTokens Phishing-as-a-Service (PhaaS) operation. Where EvilTokens (first documented by Sekoia in March 2026 and corroborated by Microsoft in April 2026) provided a turnkey Microsoft device-code phishing kit for OAuth 2.0 Device Authorization Grant (RFC 8628) abuse, ARToken is a complete downstream BEC operations environment built on top of stolen tokens. The React-based ARToken dashboard exposes over 80 documented API endpoints covering device-code initiation (/api/device/start, hardcoded operator UUID 84eb384d-cd3e-4c90-a283-c960ce557913), Primary Refresh Token lifecycle management (/prt/setup, /prt/refresh, /prt/renew, /prt/reacquire, /prt/cookie), full Outlook inbox read/send with BCC batching, inbox rule creation for forwarding and evidence suppression, SharePoint/OneDrive browse-upload-download-permission operations, cross-account keyword monitoring ('Box Monitor'), token import from external sources, and automated Cloudflare Worker phishing-page deployment. A standalone Windows desktop application, ARTBrowser, allows operators to browse hijacked sessions directly. The kit layers a seven-stage client-side anti-analysis system (headless-browser User-Agent blocking, navigator.webdriver checks, browser fingerprinting, window-dimension analysis, mouse/touch interaction telemetry, an 800ms timing gate, and non-linear movement-pattern validation) atop XOR-encrypted payloads (16-byte key), a materially more sophisticated evasion approach than the server-side X-Antibot-Token (SHA-256 of secret + Unix timestamp + '_antibot', 5-minute validity window) used by the base EvilTokens kit. Operators lure accounts-payable, finance, HR, and logistics staff at real vendor relationships with outstanding-invoice and urgency-themed emails, in several documented cases spoofing legitimate vendor contacts to reach real AP recipients at victim organizations including public-sector and life-sciences entities. Phishing infrastructure is fronted through Cloudflare Workers (observed patterns include clear90489058903-document.workers[.]dev and UUID-prefixed {uuid}-docviewer.workers[.]dev, as well as the wider EvilTokens adobe-[a-z0-9]{3}.[a-z0-9-]{3,}-s-account.workers.dev pattern), with a dedicated management panel (dashboard-bl.pamconj[.]com) and C2 API (spx.pamconj[.]com). EvilTokens itself has been tracked hitting 340+ organizations across the US, Canada, Australia, New Zealand, Germany, France, India, Switzerland, and the UAE since first detection on February 19, 2026, using multi-hop redirect chains that abuse Railway.com-hosted infrastructure, Vercel, compromised legitimate sites, and even redirects through security-vendor domains (Cisco, Trend Micro, Mimecast) to evade reputation-based filtering. Threat activity has been loosely associated with Russia-aligned clusters including Storm-2372, APT29, UTA0304, UTA0307, and UNK_AcademicFlare, alongside a related independent kit, Kali365, flagged by the FBI IC3 in a May 21, 2026 PSA (I-052126-PSA) using the identical device-code phishing mechanic. The EvilTokens/ARToken ecosystem is commercialized: EvilTokens core access sells for $1,500 one-time plus $500/month, a standalone Portal Browser for $500 lifetime, and anti-bot page add-ons distributed via a dedicated Telegram bot with 24/7 operator support. Because the initial authentication step occurs on Microsoft's own legitimate devicelogin page, the technique evades most conventional credential-phishing detections, and captured Primary Refresh Tokens persist attacker access across victim password resets, requiring explicit device-code-flow conditional access blocks and refresh-token revocation for remediation.
MITRE ATT&CK techniques used in TL-2026-1036
Exfiltration
T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1497.001 System Checks
Command and Control
T1071.001 Web Protocols; T1102 Web Service
Initial Access
T1078.004 Cloud Accounts; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Discovery
T1087.004 Cloud Account; T1538 Cloud Service Dashboard
Persistence
T1098.001 Additional Cloud Credentials; T1098.005 Device Registration
Collection
T1114.002 Remote Email Collection; T1119 Automated Collection; T1530 Data from Cloud Storage
collection
T1114.003 Email Forwarding Rule
Credential Access
T1187 Forced Authentication; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1621 Multi-Factor Authentication Request Generation
Execution
Impact
T1531 Account Access Removal; T1657 Financial Theft
lateral-movement
T1550.001 Application Access Token
Resource Development
T1583.006 Web Services; T1587.001 Malware; T1588.002 Tool
Reconnaissance
defense-impairment
Affected products and versions in ARToken: Business Email Compromise-as-a-Service Platform
- Microsoft — Microsoft 365 / Entra ID (Azure AD) OAuth 2.0 Device Authorization Grant
Vulnerable versions: all tenants with device code flow enabled
Fixed in: tenants with device code flow disabled via Conditional Access - Microsoft — SharePoint Online / OneDrive
Vulnerable versions: accessible via stolen PRT/session tokens
Fixed in: N/A - mitigated via token revocation and CA policy - Microsoft — Outlook Web Access (OWA)
Vulnerable versions: sessions established via stolen refresh/PRT tokens
Fixed in: N/A - mitigated via session/token revocation
Remediation for ARToken: Business Email Compromise-as-a-Service Platform
Immediate actions
- Block Microsoft OAuth 2.0 Device Authorization Grant flow via Conditional Access policies, with narrow exceptions for confirmed legitimate device-code use cases
- Audit and revoke all active refresh tokens and Primary Refresh Tokens for suspected compromised accounts
- Review and remove unauthorized Outlook inbox rules (forwarding, auto-delete) created without user knowledge
- Block known ARToken/EvilTokens infrastructure at email gateway and web proxy: dashboard-bl.pamconj[.]com, spx.pamconj[.]com, authdocspro[.]com, backdoor-hub[.]com, notificationsmanagersec[.]com, framebound[.]cloud
- Alert accounts-payable / finance / HR staff to outstanding-invoice and device-code social engineering lures
Workarounds
- Disable Microsoft device code authentication entirely at the tenant level where not operationally required
- Require re-authentication and step-up verification for high-risk actions (inbox rule creation, mailbox forwarding, SharePoint sharing link creation)
Longer-term hardening
- Deploy Conditional Access policies restricting device-code sign-in to managed/compliant devices only
- Implement phishing-resistant MFA (FIDO2/WebAuthn) to reduce reliance on OTP/device-code-susceptible flows
- Enable continuous access evaluation (CAE) to shorten token validity windows
- Monitor for anomalous PRT reacquisition, OWA session cookie generation, and SharePoint bulk-download activity
- Deploy detection for Cloudflare Workers-hosted phishing domains matching adobe/document/docviewer naming patterns
Weaknesses (CWE) in ARToken: Business Email Compromise-as-a-Service Platform
CWE-287, CWE-294, CWE-346
Timeline of ARToken: Business Email Compromise-as-a-Service Platform
- EvilTokens device-code phishing campaign first detected in the wild, per HackerNews/Push Security reporting; earliest samples circulating since mid-February 2026 per Sekoia.
- Reporting indicates 340+ organizations across the US, Canada, Australia, New Zealand, and Germany (later expanded to France, India, Switzerland, UAE) compromised via the campaign, with attribution loosely tied to Storm-2372, APT29, UTA0304, UTA0307, and UNK_AcademicFlare.
- Sekoia's Threat Detection & Research team publishes Part 1 of its EvilTokens analysis, documenting the device-code phishing kit, X-Antibot-Token mechanism, and initial infrastructure (500+ Cloudflare Workers domains, 1,000+ total infrastructure domains as of March 23, 2026).
- Microsoft publishes research confirming and expanding on the AI-enabled device-code phishing campaign; Sekoia publishes Part 2 with additional operational details.
- Sample ARToken phishing emails observed being sent at approximately 4-minute intervals, indicating automated bulk-send tooling.
- FBI IC3 issues Public Service Announcement I-052126-PSA on the related Kali365 phishing-as-a-service kit, which uses the identical OAuth device-code mechanism to bypass MFA on Microsoft 365 accounts.
- CyberScoop publishes coverage of the Talos ARToken research, including quotes from Talos researcher Michael Kelley describing the kit as 'more fleshed out and polished than previous instances.'
- Cisco Talos publishes detailed research on ARToken, an EvilTokens affiliate operator panel, revealing its 80+ API endpoints, seven-layer anti-analysis system, PRT persistence tooling, and full BEC operations capability (inbox rule manipulation, SharePoint exfiltration, shared access links).
Sources cited for ARToken: Business Email Compromise-as-a-Service Platform
- ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365
- This phishing kit looks more like BEC-as-a-service
- New widespread EvilTokens kit: device code phishing as-a-service (Part 1)
- Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse
- Kali365 Phishing-as-a-Service Kit Hijacks Microsoft 365 Access Tokens (IC3 PSA I-052126-PSA)
- Device Code Phishing is an Evolution in Identity Takeover
- How EvilTokens Turbocharges Old School Phishing with AI
- Microsoft 365 users targeted in device code phishing attacks
- Device Code Phishing Forensics: What We Learned from BEC Investigations in the Wild
Threats related to ARToken: Business Email Compromise-as-a-Service Platform
- ARToken Phishing Panel Abuses Microsoft OAuth Device Code Flow to Hijack Microsoft 365 Accounts (EvilTokens PhaaS)
- EvilTokens Phishing-as-a-Service: Microsoft OAuth 2.0 Device Authorization Grant (Device Code) Phishing Against Microsoft 365
- EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device Code Authentication with AES-GCM "Ghost Code" to Breach Finance, Tech, and Managed Security Firms
- EvilTokens/ARToken Device-Code Phishing Kit Bypasses MFA to Compromise Microsoft 365 Accounts
- Device Code Phishing: OAuth Device Authorization Grant Abuse Bypasses All MFA Forms, Including Passkeys
- Device Code Phishing Surge — 37x Increase Driven by EvilTokens and VENOM PhaaS Kits Targeting Microsoft 365
Detection coverage for TL-2026-1036
As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1036 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.