# ARToken Phishing Panel Abuses Microsoft OAuth Device Code Flow to Hijack Microsoft 365 Accounts (EvilTokens PhaaS)

> ARToken is a fully-featured phishing-as-a-service affiliate panel, discovered by Cisco Talos, that abuses Microsoft's OAuth 2.0 Device Authorization Grant to bypass MFA and hijack Microsoft 365 accounts, primarily targeting accounts-payable, finance, HR, and logistics staff via spear-phishing emails impersonating vendor billing contacts. The panel shares infrastructure, API contracts, and a Primary Refresh Token persistence chain with the EvilTokens PhaaS platform documented earlier in 2026 by Sekoia and Microsoft, and adds a seven-layer client-side anti-analysis system plus native Cloudflare Workers infrastructure automation.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-08-28T15:39:19.077Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1037
- **ID:** TL-2026-1037
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** EvilTokens
- **Detections:** 9 · **IOCs:** 63 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ARToken is a React-based phishing operator panel exposing 80+ API endpoints, uncovered by Cisco Talos (Michael Kelley) during an incident-response engagement in which attackers spoofed vendor invoices to compromise accounts-payable staff at a U.S. life-sciences company on April 20, 2026. The panel's management dashboard was found at dashboard-bl.pamconj[.]com, serving a 1.7MB compiled JavaScript SPA bundle titled 'ARToken Panel.'

Technically, ARToken is an affiliate build of the EvilTokens platform first documented by Sekoia's Threat Detection & Research team in March 2026 and independently confirmed at scale by Microsoft in April 2026. EvilTokens weaponizes Microsoft's OAuth 2.0 Device Authorization Grant (RFC 8628) — the flow designed for input-constrained devices such as smart TVs or IoT terminals. The kit's phishing page silently issues a device-code request to Microsoft (POST /oauth2/v2.0/devicecode) on the victim's behalf, then social-engineers the victim into completing the corresponding user-code entry on the legitimate microsoft.com/devicelogin page. Because authentication occurs entirely on genuine Microsoft infrastructure, MFA challenges are satisfied by the real victim and no credentials or OTPs are directly captured — only the resulting access/refresh tokens delivered to the attacker's backend.

ARToken escalates this further: captured refresh tokens are exchanged through a five-step chain (/prt/setup → /prt/refresh → /prt/renew → /prt/reacquire → /prt/cookie) that registers a new device in Entra ID and requests a Primary Refresh Token (PRT), which persists silent, MFA-free authentication even across victim password resets — a capability the panel explicitly flags in its configuration via a persistAfterPassChange:false setting, indicating operator awareness that plain refresh tokens (unlike PRTs) are revoked on password change.

Delivery relies on vendor-impersonation spearphishing: emails spoof legitimate vendor 'From' addresses while redirecting replies via Reply-To manipulation, deliberately fail SPF/DKIM/DMARC authentication, and link to look-alike SharePoint tenants (e.g., mononapfpcom.sharepoint[.]com) hosted as separate, attacker-controlled Microsoft 365 workspaces. Per-message mutation (randomized hex strings, inline signature images) evades exact-match content filters.

The phishing landing page itself runs a seven-layer, purely client-side anti-analysis system — User-Agent/headless-browser blocking, navigator.webdriver checks, fingerprint validation, viewport-dimension analysis, mouse/touch interaction telemetry, a minimum dwell-time gate, and organic-movement-pattern validation — before it will decrypt (via a hardcoded 16-byte XOR key) and execute its credential-harvesting payload, evading automated URL scanners that lack real browser interaction. This client-side approach is more sophisticated than the server-side X-Antibot-Token (SHA-256 of a secret + Unix timestamp + 'antibot', validated within a 5-minute window) used by earlier EvilTokens variants.

Once a token is captured it appears in the ARToken operator dashboard, which additionally provides full Outlook inbox read/send (including BCC batch sending and inbox-rule creation for evidence suppression), SharePoint/OneDrive browsing and file operations, cross-mailbox keyword monitoring ('Box Monitor'), token import/export and cross-operator trading, geo-aware phishing template injection ({city}/{country_code}/{state} placeholders), a Windows desktop tool (ARTBrowser) for out-of-band session browsing, and direct Cloudflare API integration allowing operators to spin up new phishing infrastructure (Adobe/OneDrive/DocuSign/document-viewer themed Cloudflare Workers subdomains) directly from the panel.

EvilTokens itself is sold as a subscription PhaaS via Telegram ($1,500 one-time plus $500/month, with a $500 lifetime 'Portal Browser' add-on), has been in circulation since mid-February 2026, and by March 23, 2026 Sekoia had catalogued roughly 500-1,000+ Cloudflare Workers phishing domains following two naming conventions (adobe-*, docusign-* under *-s-account.workers.dev) plus self-hosted affiliate domains. Microsoft's April 6, 2026 confirmation described the campaign as AI-augmented, with built-in automation to analyze harvested mailboxes, identify finance-related threads, and auto-draft BEC follow-up emails, and reported victim organizations across the Americas, Europe, the Middle East, Asia, and Oceania, concentrated in the US, Canada, France, Australia, India, Switzerland, and the UAE. Cisco Talos assesses ARToken has no clear attribution beyond being 'more of an affiliate's customized build than anything else,' and the panel went dark/relocated shortly after Talos's July 1, 2026 public disclosure.

## MITRE ATT&CK

- T1589.002 Gather Victim Identity Information: Email Addresses
- T1583.006 Acquire Infrastructure: Web Services
- T1587.001 Develop Capabilities: Malware
- T1586.003 Compromise Accounts: Cloud Accounts
- T1566.002 Phishing: Spearphishing Link
- T1199 Trusted Relationship
- T1204.001 User Execution: Malicious Link
- T1098.001 Account Manipulation: Additional Cloud Credentials
- T1098.005 Account Manipulation: Device Registration
- T1114.003 Email Forwarding Rule
- T1027 Obfuscated Files or Information
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1684.001 Impersonation
- T1528 Steal Application Access Token
- T1111 Multi-Factor Authentication Interception
- T1526 Cloud Service Discovery
- T1114.002 Email Collection: Remote Email Collection
- T1213.002 Data from Information Repositories: SharePoint
- T1119 Automated Collection
- T1071.001 Application Layer Protocol: Web Protocols
- T1102 Web Service
- T1567 Exfiltration Over Web Service
- T1531 Account Access Removal
- T1598.002 Spearphishing Attachment
- T1598.004 Spearphishing Voice
- T1078.004 Valid Accounts: Cloud Accounts
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1140 Deobfuscate/Decode Files or Information
- T1187 Forced Authentication
- T1621 Multi-Factor Authentication Request Generation
- T1087.004 Account Discovery: Cloud Account
- T1580 Cloud Infrastructure Discovery
- T1069.003 Permission Groups Discovery: Cloud Groups
- T1530 Data from Cloud Storage
- T1102.002 Web Service: Bidirectional Communication
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1020 Automated Exfiltration
- T1657 Financial Theft
- T1534 Internal Spearphishing

## Sources

- [ARToken phishing panel hijacks Microsoft 365 accounts](https://www.helpnetsecurity.com/2026/07/01/artoken-phishing-panel-microsoft-365-accounts/)
- [ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365](https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/)
- [This phishing kit looks more like BEC-as-a-service](https://cyberscoop.com/artoken-bec-platform-cisco-talos/)
- [Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse](https://thehackernews.com/2026/03/device-code-phishing-hits-340-microsoft.html)
- [New widespread EvilTokens kit: device code phishing as-a-service (Part 1)](https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1)
- [EvilTokens: an AI-augmented phishing kit for automating BEC fraud (Part 2)](https://blog.sekoia.io/eviltokens-an-ai-augmented-phishing-as-a-service-for-automating-bec-fraud-part-2)
- [EvilTokens ramps up device code phishing targeting Microsoft 365 users](https://www.helpnetsecurity.com/2026/03/31/eviltokens-phishing-microsoft-365/)
- [EvilTokens: Device-Code Phishing Renders MFA Irrelevant](https://labs.cloudsecurityalliance.org/research/csa-research-note-oauth-device-code-phishing-eviltokens-2026/)
- [New EvilTokens service fuels Microsoft device code phishing attacks](https://www.bleepingcomputer.com/news/security/new-eviltokens-service-fuels-microsoft-device-code-phishing-attacks/)
- [Inside an AI-enabled device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2026/04/06/ai-enabled-device-code-phishing-campaign-april-2026/)
- [EvilTokens Uses Stolen Microsoft 365 Tokens and AI to Scale BEC Attacks](https://cybersecuritytimes.com/eviltokens-microsoft-365-tokens-ai/)
- [EvilTokens: Turning OAuth Device Codes into Full-Scale BEC Operations](https://abnormal.ai/blog/eviltokens-oauth-device-codes-bec-operations)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1037