# ARToken: Business Email Compromise-as-a-Service Platform Targeting Microsoft 365 (Cisco Talos / EvilTokens Affiliate)

> Cisco Talos disclosed ARToken, a fully-featured Phishing-as-a-Service (PhaaS) operator panel that shares infrastructure, API contracts, and operational patterns with the EvilTokens platform. ARToken exposes 80+ API endpoints for OAuth 2.0 device-code phishing, Primary Refresh Token (PRT) persistence, inbox rule manipulation, SharePoint exfiltration, and shared-access-link abuse against Microsoft 365 tenants, wrapped in a seven-layer client-side anti-analysis system.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-07-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1036
- **ID:** TL-2026-1036
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** EvilTokens (Russia)
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On July 1, 2026, Cisco Talos published research on ARToken, an affiliate operator panel of the EvilTokens Phishing-as-a-Service (PhaaS) operation. Where EvilTokens (first documented by Sekoia in March 2026 and corroborated by Microsoft in April 2026) provided a turnkey Microsoft device-code phishing kit for OAuth 2.0 Device Authorization Grant (RFC 8628) abuse, ARToken is a complete downstream BEC operations environment built on top of stolen tokens. The React-based ARToken dashboard exposes over 80 documented API endpoints covering device-code initiation (/api/device/start, hardcoded operator UUID 84eb384d-cd3e-4c90-a283-c960ce557913), Primary Refresh Token lifecycle management (/prt/setup, /prt/refresh, /prt/renew, /prt/reacquire, /prt/cookie), full Outlook inbox read/send with BCC batching, inbox rule creation for forwarding and evidence suppression, SharePoint/OneDrive browse-upload-download-permission operations, cross-account keyword monitoring ('Box Monitor'), token import from external sources, and automated Cloudflare Worker phishing-page deployment. A standalone Windows desktop application, ARTBrowser, allows operators to browse hijacked sessions directly. The kit layers a seven-stage client-side anti-analysis system (headless-browser User-Agent blocking, navigator.webdriver checks, browser fingerprinting, window-dimension analysis, mouse/touch interaction telemetry, an 800ms timing gate, and non-linear movement-pattern validation) atop XOR-encrypted payloads (16-byte key), a materially more sophisticated evasion approach than the server-side X-Antibot-Token (SHA-256 of secret + Unix timestamp + '_antibot', 5-minute validity window) used by the base EvilTokens kit. Operators lure accounts-payable, finance, HR, and logistics staff at real vendor relationships with outstanding-invoice and urgency-themed emails, in several documented cases spoofing legitimate vendor contacts to reach real AP recipients at victim organizations including public-sector and life-sciences entities. Phishing infrastructure is fronted through Cloudflare Workers (observed patterns include clear90489058903-document.workers[.]dev and UUID-prefixed {uuid}-docviewer.workers[.]dev, as well as the wider EvilTokens adobe-[a-z0-9]{3}.[a-z0-9-]{3,}-s-account.workers.dev pattern), with a dedicated management panel (dashboard-bl.pamconj[.]com) and C2 API (spx.pamconj[.]com). EvilTokens itself has been tracked hitting 340+ organizations across the US, Canada, Australia, New Zealand, Germany, France, India, Switzerland, and the UAE since first detection on February 19, 2026, using multi-hop redirect chains that abuse Railway.com-hosted infrastructure, Vercel, compromised legitimate sites, and even redirects through security-vendor domains (Cisco, Trend Micro, Mimecast) to evade reputation-based filtering. Threat activity has been loosely associated with Russia-aligned clusters including Storm-2372, APT29, UTA0304, UTA0307, and UNK_AcademicFlare, alongside a related independent kit, Kali365, flagged by the FBI IC3 in a May 21, 2026 PSA (I-052126-PSA) using the identical device-code phishing mechanic. The EvilTokens/ARToken ecosystem is commercialized: EvilTokens core access sells for $1,500 one-time plus $500/month, a standalone Portal Browser for $500 lifetime, and anti-bot page add-ons distributed via a dedicated Telegram bot with 24/7 operator support. Because the initial authentication step occurs on Microsoft's own legitimate devicelogin page, the technique evades most conventional credential-phishing detections, and captured Primary Refresh Tokens persist attacker access across victim password resets, requiring explicit device-code-flow conditional access blocks and refresh-token revocation for remediation.

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1583.006 Web Services
- T1587.001 Malware
- T1588.002 Tool
- T1566.002 Spearphishing Link
- T1566.001 Spearphishing Attachment
- T1078.004 Cloud Accounts
- T1204.001 Malicious Link
- T1098.001 Additional Cloud Credentials
- T1098.005 Device Registration
- T1114.003 Email Forwarding Rule
- T1528 Steal Application Access Token
- T1539 Steal Web Session Cookie
- T1187 Forced Authentication
- T1621 Multi-Factor Authentication Request Generation
- T1027 Obfuscated Files or Information
- T1550.001 Application Access Token
- T1497.001 System Checks
- T1685.002 Disable or Modify Cloud Log
- T1036 Masquerading
- T1538 Cloud Service Dashboard
- T1087.004 Cloud Account
- T1114.002 Remote Email Collection
- T1530 Data from Cloud Storage
- T1119 Automated Collection
- T1102 Web Service
- T1071.001 Web Protocols
- T1567 Exfiltration Over Web Service
- T1020 Automated Exfiltration
- T1531 Account Access Removal
- T1657 Financial Theft

## Sources

- [ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365](https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/)
- [This phishing kit looks more like BEC-as-a-service](https://cyberscoop.com/artoken-bec-platform-cisco-talos/)
- [New widespread EvilTokens kit: device code phishing as-a-service (Part 1)](https://www.sekoia.com/blog/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1)
- [Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse](https://thehackernews.com/2026/03/device-code-phishing-hits-340-microsoft.html)
- [Kali365 Phishing-as-a-Service Kit Hijacks Microsoft 365 Access Tokens (IC3 PSA I-052126-PSA)](https://www.ic3.gov/PSA/2026/PSA260521)
- [Device Code Phishing is an Evolution in Identity Takeover](https://www.proofpoint.com/us/blog/threat-insight/device-code-phishing-evolution-identity-takeover)
- [How EvilTokens Turbocharges Old School Phishing with AI](https://www.huntress.com/blog/device-code-phishing-ai-mfa-bypass)
- [Microsoft 365 users targeted in device code phishing attacks](https://www.helpnetsecurity.com/2025/12/18/microsoft-365-device-code-phishing/)
- [Device Code Phishing Forensics: What We Learned from BEC Investigations in the Wild](https://research.eye.security/device-code-phishing-forensics/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1036