ARToken Phishing Panel Abuses Microsoft OAuth Device Code Flow to Hijack Microsoft 365 Accounts (EvilTokens PhaaS) — Threadlinqs Intelligence
As of 2026-07-28, ARToken Phishing Panel Abuses Microsoft OAuth Device Code Flow to Hijack Microsoft 365 Accounts (EvilTokens PhaaS) is a high-severity malware threat attributed to EvilTokens (eviltokensadmin), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 54 indicators of compromise.
Threat ID: TL-2026-1037 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Updated: 2026-07-28 · 2 updates · revalidated 2× · latest source
Attribution: EvilTokens (eviltokensadmin) · FINANCIAL
ARToken is a fully-featured phishing-as-a-service affiliate panel, discovered by Cisco Talos, that abuses Microsoft's OAuth 2.0 Device Authorization Grant to bypass MFA and hijack Microsoft 365
ARToken is a React-based phishing operator panel exposing 80+ API endpoints, uncovered by Cisco Talos (Michael Kelley) during an incident-response engagement in which attackers spoofed vendor invoices to compromise accounts-payable staff at a U.S. life-sciences company on April 20, 2026. The panel's management dashboard was found at dashboard-bl.pamconj[.]com, serving a 1.7MB compiled JavaScript SPA bundle titled 'ARToken Panel.'
Technically, ARToken is an affiliate build of the EvilTokens platform first documented by Sekoia's Threat Detection & Research team in March 2026 and independently confirmed at scale by Microsoft in April 2026. EvilTokens weaponizes Microsoft's OAuth 2.0 Device Authorization Grant (RFC 8628) — the flow designed for input-constrained devices such as smart TVs or IoT terminals. The kit's phishing page silently issues a device-code request to Microsoft (POST /oauth2/v2.0/devicecode) on the victim's behalf, then social-engineers the victim into completing the corresponding user-code entry on the legitimate microsoft.com/devicelogin page. Because authentication occurs entirely on genuine Microsoft infrastructure, MFA challenges are satisfied by the real victim and no credentials or OTPs are directly captured — only the resulting access/refresh tokens delivered to the attacker's backend.
ARToken escalates this further: captured refresh tokens are exchanged through a five-step chain (/prt/setup → /prt/refresh → /prt/renew → /prt/reacquire → /prt/cookie) that registers a new device in Entra ID and requests a Primary Refresh Token (PRT), which persists silent, MFA-free authentication even across victim password resets — a capability the panel explicitly flags in its configuration via a persistAfterPassChange:false setting, indicating operator awareness that plain refresh tokens (unlike PRTs) are revoked on password change.
Delivery relies on vendor-impersonation spearphishing: emails spoof legitimate vendor 'From' addresses while redirecting replies via Reply-To manipulation, deliberately fail SPF/DKIM/DMARC authentication, and link to look-alike SharePoint tenants (e.g., mononapfpcom.sharepoint[.]com) hosted as separate, attacker-controlled Microsoft 365 workspaces. Per-message mutation (randomized hex strings, inline signature images) evades exact-match content filters.
The phishing landing page itself runs a seven-layer, purely client-side anti-analysis system — User-Agent/headless-browser blocking, navigator.webdriver checks, fingerprint validation, viewport-dimension analysis, mouse/touch interaction telemetry, a minimum dwell-time gate, and organic-movement-pattern validation — before it will decrypt (via a hardcoded 16-byte XOR key) and execute its credential-harvesting payload, evading automated URL scanners that lack real browser interaction. This client-side approach is more sophisticated than the server-side X-Antibot-Token (SHA-256 of a secret + Unix timestamp + 'antibot', validated within a 5-minute window) used by earlier EvilTokens variants.
Once a token is captured it appears in the ARToken operator dashboard, which additionally provides full Outlook inbox read/send (including BCC batch sending and inbox-rule creation for evidence suppression), SharePoint/OneDrive browsing and file operations, cross-mailbox keyword monitoring ('Box Monitor'), token import/export and cross-operator trading, geo-aware phishing template injection ({city}/{country_code}/{state} placeholders), a Windows desktop tool (ARTBrowser) for out-of-band session browsing, and direct Cloudflare API integration allowing operators to spin up new phishing infrastructure (Adobe/OneDrive/DocuSign/document-viewer themed Cloudflare Workers subdomains) directly from the panel.
EvilTokens itself is sold as a subscription PhaaS via Telegram ($1,500 one-time plus $500/month, with a $500 lifetime 'Portal Browser' add-on), has been in circulation since mid-February 2026, and by March 23, 2026 Sekoia had catalogued roughly 500-1,000+
Weaknesses (CWE)
CWE-290, CWE-287, CWE-311
Target sectors: life-sciences, finance, hr, logistics, transport
Target regions: North America, Europe, Middle East, Asia, Oceania, united states of america, canada, france, australia, india, switzerland, united arab emirates
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 54 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1589.002, T1583.006, T1587.001, T1586.003, T1566.002, T1199, T1204.001, T1098.001, T1098.005, T1114.003