ARToken Phishing Panel Abuses Microsoft OAuth Device Code Flow to Hijack Microsoft 365 Accounts (EvilTokens PhaaS)

ARToken Phishing Panel Abuses Microsoft OAuth Device Code (TL-2026-1037), also tracked as ARToken, is a high-severity malware campaign, first published 2026-07-01 and last reviewed 2026-08-28. It is attributed to ARToken affiliate operator with medium confidence, affects Microsoft Microsoft 365 / Entra ID (Azure AD) OAuth 2.0 Device, maps to 41 MITRE ATT&CK techniques (T1020, T1027, T1069.003), and is covered by 9 detection rules and 63 indicators of compromise.

Key facts for TL-2026-1037

Threat ID
TL-2026-1037
Also known as
ARToken, EvilTokens, ARToken Panel, ARTSender, ARTBrowser
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-01
Last reviewed
2026-08-28
Attribution
ARToken affiliate operator
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
life-sciences, finance, hr, logistics, transport
Target regions
North America, Europe, Middle East, Asia, Oceania, united states of america, canada, france, australia, india, switzerland, united arab emirates
Detection rules
9
Indicators of compromise
63
Updates
2026-08-28 · 3 updates · revalidated 3× · latest source

Malware and tooling in ARToken Phishing Panel Abuses Microsoft OAuth Device Code

Malware and tooling: EvilTokens, ARTBrowser, ARTSender, ARToken Panel, MailVault

ARToken is a fully-featured phishing-as-a-service affiliate panel, discovered by Cisco Talos, that abuses Microsoft's OAuth 2.0 Device Authorization Grant to bypass MFA and hijack Microsoft 365 accounts, primarily targeting accounts-payable, finance, HR, and logistics staff via spear-phishing emails impersonating vendor billing contacts. The panel shares infrastructure, API contracts, and a Primary Refresh Token persistence chain with the EvilTokens PhaaS platform documented earlier in 2026 by Sekoia and Microsoft, and adds a seven-layer client-side anti-analysis system plus native Cloudflare Workers infrastructure automation.

How ARToken Phishing Panel Abuses Microsoft OAuth Device Code works

ARToken is a React-based phishing operator panel exposing 80+ API endpoints, uncovered by Cisco Talos (Michael Kelley) during an incident-response engagement in which attackers spoofed vendor invoices to compromise accounts-payable staff at a U.S. life-sciences company on April 20, 2026. The panel's management dashboard was found at dashboard-bl.pamconj[.]com, serving a 1.7MB compiled JavaScript SPA bundle titled 'ARToken Panel.'

Technically, ARToken is an affiliate build of the EvilTokens platform first documented by Sekoia's Threat Detection & Research team in March 2026 and independently confirmed at scale by Microsoft in April 2026. EvilTokens weaponizes Microsoft's OAuth 2.0 Device Authorization Grant (RFC 8628) — the flow designed for input-constrained devices such as smart TVs or IoT terminals. The kit's phishing page silently issues a device-code request to Microsoft (POST /oauth2/v2.0/devicecode) on the victim's behalf, then social-engineers the victim into completing the corresponding user-code entry on the legitimate microsoft.com/devicelogin page. Because authentication occurs entirely on genuine Microsoft infrastructure, MFA challenges are satisfied by the real victim and no credentials or OTPs are directly captured — only the resulting access/refresh tokens delivered to the attacker's backend.

ARToken escalates this further: captured refresh tokens are exchanged through a five-step chain (/prt/setup → /prt/refresh → /prt/renew → /prt/reacquire → /prt/cookie) that registers a new device in Entra ID and requests a Primary Refresh Token (PRT), which persists silent, MFA-free authentication even across victim password resets — a capability the panel explicitly flags in its configuration via a persistAfterPassChange:false setting, indicating operator awareness that plain refresh tokens (unlike PRTs) are revoked on password change.

Delivery relies on vendor-impersonation spearphishing: emails spoof legitimate vendor 'From' addresses while redirecting replies via Reply-To manipulation, deliberately fail SPF/DKIM/DMARC authentication, and link to look-alike SharePoint tenants (e.g., mononapfpcom.sharepoint[.]com) hosted as separate, attacker-controlled Microsoft 365 workspaces. Per-message mutation (randomized hex strings, inline signature images) evades exact-match content filters.

The phishing landing page itself runs a seven-layer, purely client-side anti-analysis system — User-Agent/headless-browser blocking, navigator.webdriver checks, fingerprint validation, viewport-dimension analysis, mouse/touch interaction telemetry, a minimum dwell-time gate, and organic-movement-pattern validation — before it will decrypt (via a hardcoded 16-byte XOR key) and execute its credential-harvesting payload, evading automated URL scanners that lack real browser interaction. This client-side approach is more sophisticated than the server-side X-Antibot-Token (SHA-256 of a secret + Unix timestamp + 'antibot', validated within a 5-minute window) used by earlier EvilTokens variants.

Once a token is captured it appears in the ARToken operator dashboard, which additionally provides full Outlook inbox read/send (including BCC batch sending and inbox-rule creation for evidence suppression), SharePoint/OneDrive browsing and file operations, cross-mailbox keyword monitoring ('Box Monitor'), token import/export and cross-operator trading, geo-aware phishing template injection ({city}/{country_code}/{state} placeholders), a Windows desktop tool (ARTBrowser) for out-of-band session browsing, and direct Cloudflare API integration allowing operators to spin up new phishing infrastructure (Adobe/OneDrive/DocuSign/document-viewer themed Cloudflare Workers subdomains) directly from the panel.

EvilTokens itself is sold as a subscription PhaaS via Telegram ($1,500 one-time plus $500/month, with a $500 lifetime 'Portal Browser' add-on), has been in circulation since mid-February 2026, and by March 23, 2026 Sekoia had catalogued roughly 500-1,000+ Cloudflare Workers phishing domains following two naming conventions (adobe-*, docusign-* under *-s-account.workers.dev) plus self-hosted affiliate domains. Microsoft's April 6, 2026 confirmation described the campaign as AI-augmented, with built-in automation to analyze harvested mailboxes, identify finance-related threads, and auto-draft BEC follow-up emails, and reported victim organizations across the Americas, Europe, the Middle East, Asia, and Oceania, concentrated in the US, Canada, France, Australia, India, Switzerland, and the UAE. Cisco Talos assesses ARToken has no clear attribution beyond being 'more of an affiliate's customized build than anything else,' and the panel went dark/relocated shortly after Talos's July 1, 2026 public disclosure.

MITRE ATT&CK techniques used in TL-2026-1037

Exfiltration

T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service; T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Defense Evasion

T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1684.001 Impersonation

Discovery

T1069.003 Permission Groups Discovery: Cloud Groups; T1087.004 Account Discovery: Cloud Account; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1102 Web Service; T1102.002 Web Service: Bidirectional Communication

Persistence

T1078.004 Valid Accounts: Cloud Accounts; T1098.001 Account Manipulation: Additional Cloud Credentials; T1098.005 Account Manipulation: Device Registration

Credential Access

T1111 Multi-Factor Authentication Interception; T1187 Forced Authentication; T1528 Steal Application Access Token; T1621 Multi-Factor Authentication Request Generation

Collection

T1114.002 Email Collection: Remote Email Collection; T1119 Automated Collection; T1213.002 Data from Information Repositories: SharePoint; T1530 Data from Cloud Storage

collection

T1114.003 Email Forwarding Rule

Initial Access

T1199 Trusted Relationship; T1566.001 Phishing: Spearphishing Attachment; T1566.002 Phishing: Spearphishing Link

Execution

T1204.001 User Execution: Malicious Link

Impact

T1531 Account Access Removal; T1657 Financial Theft

Lateral Movement

T1534 Internal Spearphishing

lateral-movement

T1550.001 Use Alternate Authentication Material: Application Access Token; T1550.004 Use Alternate Authentication Material: Web Session Cookie

Resource Development

T1583.006 Acquire Infrastructure: Web Services; T1586.003 Compromise Accounts: Cloud Accounts; T1587.001 Develop Capabilities: Malware

Reconnaissance

T1589.002 Gather Victim Identity Information: Email Addresses

reconnaissance

T1598.002 Spearphishing Attachment; T1598.004 Spearphishing Voice

Affected products and versions in ARToken Phishing Panel Abuses Microsoft OAuth Device Code

  • Microsoft — Microsoft 365 / Entra ID (Azure AD) OAuth 2.0 Device Authorization Grant
    Vulnerable versions: all tenants with device code flow enabled
    Fixed in: N/A - mitigated via Conditional Access policy, not a patch
  • Microsoft — SharePoint Online / OneDrive for Business
    Vulnerable versions: accessed post-compromise via stolen tokens
    Fixed in: N/A
  • Cloudflare — Cloudflare Workers (workers.dev)
    Vulnerable versions: abused as free hosting infrastructure for phishing pages
    Fixed in: N/A

Remediation for ARToken Phishing Panel Abuses Microsoft OAuth Device Code

Patches

  • No software vulnerability is patched by vendor; mitigation is configuration-based (Conditional Access / Entra ID policy) rather than a code patch

Immediate actions

  • Block or restrict the OAuth 2.0 Device Authorization Grant flow tenant-wide via Conditional Access unless explicitly required for input-constrained devices
  • Block known ARToken/EvilTokens IOC domains (pamconj[.]com and subdomains, authdocspro[.]com, backdoor-hub[.]com, framebound[.]cloud) at email gateway and web proxy
  • Alert on and quarantine inbound mail with SPF/DKIM/DMARC compauth=none, especially with vendor-invoice or SharePoint-link themes
  • Revoke all active refresh tokens and Primary Refresh Tokens, and force re-registration of any suspicious Entra ID devices, for accounts-payable/finance/HR staff
  • Hunt for Cloudflare Workers *.workers.dev phishing subdomains matching adobe-, docusign-, onedrive-, or docviewer- naming patterns in proxy logs

Workarounds

  • Disable the device code authorization flow entirely for tenants that do not operationally require it
  • Require admin consent and monitoring for any new device registration tied to refresh-token redemption

Longer-term hardening

  • Enforce Conditional Access policies that restrict device code flow to managed/compliant devices and known network locations
  • Deploy phishing-resistant authentication (FIDO2/WebAuthn) for finance, HR, and logistics roles to reduce dependence on token-based MFA that device-code phishing bypasses
  • Implement continuous access evaluation (CAE) and session risk-based re-authentication to shorten the useful life of stolen tokens
  • Monitor Entra ID sign-in logs for anomalous device code grant usage, new device registrations, and PRT issuance patterns
  • Deploy inbox-rule creation and mail-forwarding anomaly detection to catch BEC persistence mechanisms

Weaknesses (CWE) in ARToken Phishing Panel Abuses Microsoft OAuth Device Code

CWE-290, CWE-287, CWE-311

Timeline of ARToken Phishing Panel Abuses Microsoft OAuth Device Code

Showing the 20 most recent tracked events.

  • Microsoft first observes the Russia-aligned actor Storm-2372 conducting device-code phishing against governments and NGOs — the technique EvilTokens later commoditizes as a PhaaS kit.
  • Microsoft publishes 'Storm-2372 conducts device code phishing campaign,' the first widely-cited technical writeup of Microsoft 365 device-code phishing, predating EvilTokens' commercial launch.
  • EvilTokens phishing pages begin circulating among cybercriminal affiliates via Telegram (mid-February 2026, per Sekoia)
  • Huntress confirms active EvilTokens phishing cases in the wild, shortly after the kit's Telegram launch.
  • Sekoia's Threat Detection & Research team uncovers EvilTokens as a turnkey Microsoft device code phishing PhaaS kit and publishes initial two-part analysis
  • A large-scale EvilTokens device-code phishing wave begins, ultimately reaching 340+ Microsoft 365 organizations across the US, Canada, Australia, New Zealand, and Germany within roughly five weeks.
  • Threat Detection & Research team creates a YARA rule to detect EvilTokens phishing pages based on characteristic AES-GCM/Web Crypto API strings.
  • Sekoia collects 66 EvilTokens phishing attachments for analysis.
  • Sekoia catalogues roughly 500-1,000+ Cloudflare Workers phishing domains following adobe-*/docusign-* naming conventions, plus self-hosted affiliate domains (authdocspro[.]com, backdoor-hub[.]com, framebound[.]cloud)
  • Public reporting describes device code phishing hitting 340+ Microsoft 365 organizations across five countries via OAuth abuse
  • Microsoft Security Response Center publishes analysis confirming an AI-enabled device code phishing campaign, describing AI-driven mailbox analysis and automated BEC email drafting, with victims across the Americas, Europe, Middle East, Asia, and Oceania
  • Cisco Talos incident response engagement identifies two near-identical spearphishing emails sent ~4 minutes apart targeting accounts-payable staff at a U.S. life-sciences organization, spoofing a legitimate vendor and leading to Microsoft 365 account compromise via device code phishing
  • Cloud Security Alliance publishes a research note characterizing EvilTokens device-code phishing as rendering MFA irrelevant
  • The FBI's IC3 issues a Public Service Announcement warning about Kali365, a separate but related Telegram-distributed PhaaS kit that also weaponizes Microsoft 365 device-code phishing.
  • ESET's WeLiveSecurity publishes 'EvilTokens: A phishing attack that doesn't steal your password,' a general-audience explainer of the campaign.
  • Cybersecuritynews.com reports EvilTokens breaching finance firms across US and European businesses with published sector exposure percentages.
  • The ARToken management panel (dashboard-bl.pamconj[.]com) goes dark or relocates shortly following public disclosure
  • Cisco Talos (Michael Kelley) publicly discloses the ARToken affiliate panel, its 80+ API endpoint dashboard, seven-layer anti-analysis system, and its technical linkage to EvilTokens; coverage picked up by Help Net Security and CyberScoop
  • The Hacker News reports a new 'Ghost Phishing' wave from EvilTokens breaking through traditional email security controls via client-side AES-GCM decryption of phishing payloads.
  • Cisco Talos publishes its Q2 2026 IR Trends report identifying ARToken/EvilTokens as an active toolset in Talos IR engagements, alongside record phishing (>50%) and authentication-abuse (65%) rates for the quarter.

Update history for TL-2026-1037

Sources cited for ARToken Phishing Panel Abuses Microsoft OAuth Device Code

Threats related to ARToken Phishing Panel Abuses Microsoft OAuth Device Code

Detection coverage for TL-2026-1037

As of 2026-08-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1037 across Splunk SPL, Microsoft KQL and Sigma, covering 63 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats