ARToken PhaaS Platform Exposes EvilTokens-Affiliated Microsoft 365 Device Code Phishing Toolkit

ARToken PhaaS Platform Exposes EvilTokens-Affiliated (TL-2026-1107), also tracked as ARToken Panel, is a high-severity phishing campaign, first published 2026-07-05. It is attributed to ARToken PhaaS affiliates with low confidence, affects Microsoft Microsoft 365 (Entra ID / Azure AD OAuth 2.0 Device, maps to 23 MITRE ATT&CK techniques (T1027, T1071, T1078), and is covered by 9 detection rules and 29 indicators of compromise.

Key facts for TL-2026-1107

Threat ID
TL-2026-1107
Also known as
ARToken Panel, EvilTokens PhaaS, Device Code Phishing Kit
Severity
HIGH
Status
ACTIVE
Category
PHISHING
First published
2026-07-05
Last reviewed
2026-07-05
Attribution
ARToken PhaaS affiliates
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
finance, humanresources, logistics, lifesciences, publicsector, accountspayable, hospitality
Target regions
North America, Europe, Middle East, Asia-Pacific, Africa
Detection rules
9
Indicators of compromise
29

Malware and tooling in ARToken PhaaS Platform Exposes EvilTokens-Affiliated

Malware and tooling: ARToken, EvilTokens, ARToken Panel, GPT-4o-mini, Groq-hosted Llama models, Portal Browser

Cisco Talos discovered ARToken, a phishing-as-a-service (PhaaS) operator panel affiliated with the EvilTokens platform, exposing a React-based dashboard with 80+ API endpoints used to abuse Microsoft's OAuth 2.0 Device Authorization Grant flow, steal Microsoft 365 access tokens and Primary Refresh Tokens (PRTs), and run full business email compromise (BEC) operations against Outlook, SharePoint, and OneDrive.

How ARToken PhaaS Platform Exposes EvilTokens-Affiliated works

ARToken is a phishing-as-a-service (PhaaS) operator panel identified by Cisco Talos researcher Michael Kelley that operates as a paid affiliate of EvilTokens, a device-code phishing kit first documented by Sekoia's Threat Detection & Research (TDR) team in March 2026 and separately analyzed by Microsoft Threat Intelligence in April 2026. ARToken shares an identical API contract, backend commands, and deployment model with EvilTokens, but Talos assesses it as a more mature, more polished affiliate build with materially stronger anti-analysis capabilities.

The platform abuses Microsoft's legitimate OAuth 2.0 Device Authorization Grant (RFC 8628), a workflow designed for input-constrained devices. Victims are lured (commonly via invoice or document-themed emails referencing a real vendor relationship) into visiting the legitimate microsoft.com/devicelogin page and entering a device code that was actually generated by the attacker's backend via a proxied POST request to Microsoft's device authorization endpoint (mirroring the EvilTokens `POST /api/device/start` call pattern, historically paired with a server-side `X-Antibot-Token` 64-character hex header). Because the victim authenticates on Microsoft's real, unmodified login page with their own credentials and MFA, no phishing-detectable credential prompt or MFA challenge is ever shown to the victim -- the attacker's polling backend simply receives the resulting access and refresh tokens once the user approves the code. Operators then escalate the stolen token into a Primary Refresh Token (PRT) by registering a new device against the compromised identity, granting persistent access that survives password resets and refresh-token revocation attempts that don't also address the rogue device object.

The ARToken panel itself is a React single-page application exposing over 80 REST API endpoints covering device-code initiation, PRT setup/refresh/renewal/reacquisition (even after expiry), full Outlook mailbox access (read, send-as, attachment download), hidden inbox-rule creation for auto-forward/auto-delete, cross-mailbox keyword monitoring, and SharePoint/OneDrive file browsing and exfiltration through look-alike, attacker-hosted tenant workspaces linked from anchor text that visually points to legitimate sharepoint.com URLs. A companion product, "Portal Browser," is sold separately for a $500 lifetime fee as a standalone session-hijacking browser. EvilTokens/ARToken access is commercialized at $1,500 setup plus $500/month, marketed and sold through Telegram-based sales channels, consistent with the broader Malware/Phishing-as-a-Service economy.

Talos's flagship case study involved an invoice-themed lure sent to a U.S. life-sciences company, spoofing the accounts-payable contact at a real Wisconsin-based plumbing and fire-protection vendor with which the target had a genuine business relationship -- exploiting the fact that accounts-payable staff are conditioned to respond to outstanding-invoice inquiries. Near-identical lure emails were observed four minutes apart, consistent with automated, AI-assisted lure generation. EvilTokens' second-stage tooling chains Groq-hosted Llama models for automated financial-exposure scoring of compromised mailboxes and GPT-4o-mini for email translation/localization, generating three tailored BEC scenarios per compromised mailbox -- turning simple token theft into what Talos and other researchers describe as "a complete BEC operations environment" rather than a conventional phishing kit.

Defense evasion is materially upgraded versus earlier EvilTokens builds: ARToken implements a seven-layer anti-analysis screening chain (browser/automation fingerprinting, headless-browser and crawler detection, mouse-movement/touch validation, and timing checks) combined with client-side XOR-encrypted payload delivery, superseding the simpler server-side X-Antibot-Token check used in the base EvilTokens kit. Infrastructure is built almost entirely on abused legitimate cloud platforms -- Cloudflare Workers (*.workers.dev), Vercel (*.vercel.app), AWS Lambda, and Railway.com-hosted backend automation nodes -- to blend malicious traffic in with normal SaaS activity and frustrate domain-reputation-based blocking. By the time of Microsoft's April 2026 publication, the broader EvilTokens ecosystem (which ARToken affiliates from) was tracked operating roughly 500 Cloudflare Workers domains and over 1,000-2,000 individual phishing pages, with Microsoft observing 10-15 distinct new campaigns launching daily, each hitting hundreds of organizations with unique, pattern-detection-evading payloads.

This campaign follows and technically resembles the device-code phishing technique first mass-documented by Microsoft against Storm-2372, a suspected Russia-aligned actor Microsoft assessed with moderate confidence, active since around August 2024 against government, NGO, IT/technology, defense, telecom, health, higher-education, and energy targets across Europe, North America, Africa, and the Middle East. However, Talos explicitly notes it has not fully determined the breadth of ARToken's usage or the identity of any specific threat actor(s) operating behind this affiliate panel; EvilTokens/ARToken is a commercially sold, criminal PhaaS product used by multiple financially motivated affiliates for BEC and invoice fraud, and is treated here as attributionally distinct from -- though tactically related to -- the earlier, differently-motivated Storm-2372 campaign. Confirmed ARToken/EvilTokens targeting includes finance, HR, logistics, life-sciences, and public-sector organizations across multiple regions. The specific ARToken panel documented by Talos went dark shortly after publication and is assessed to have likely relocated to new infrastructure.

MITRE ATT&CK techniques used in TL-2026-1107

Defense Evasion

T1027 Obfuscated Files or Information; T1497 Virtualization/Sandbox Evasion

Command and Control

T1071 Application Layer Protocol; T1102 Web Service

Privilege Escalation

T1078 Valid Accounts

Discovery

T1087 Account Discovery; T1526 Cloud Service Discovery

Persistence

T1098 Account Manipulation; T1137 Office Application Startup

Collection

T1114 Email Collection; T1119 Automated Collection; T1213 Data from Information Repositories

Execution

T1204 User Execution

Credential Access

T1528 Steal Application Access Token

lateral-movement

T1550 Use Alternate Authentication Material

Lateral Movement

T1550 Use Alternate Authentication Material

defense-impairment

T1556 Modify Authentication Process

Initial Access

T1566 Phishing

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583 Acquire Infrastructure; T1588 Obtain Capabilities

Reconnaissance

T1589 Gather Victim Identity Information

Impact

T1657 Financial Theft

stealth

T1684.001 Impersonation

Affected products and versions in ARToken PhaaS Platform Exposes EvilTokens-Affiliated

  • Microsoft — Microsoft 365 (Entra ID / Azure AD OAuth 2.0 Device Authorization Grant)
    Vulnerable versions: all Microsoft 365 / Entra ID tenants with device-code authentication flow enabled and unrestricted
    Fixed in: N/A - abuse of legitimate protocol; mitigated only via Conditional Access policies restricting/blocking the device-code authentication flow
  • Microsoft — SharePoint Online / OneDrive
    Vulnerable versions: tenants accessible via compromised Microsoft 365 tokens/PRTs
    Fixed in: N/A - downstream exposure of compromised identity, not a SharePoint/OneDrive vulnerability

Remediation for ARToken PhaaS Platform Exposes EvilTokens-Affiliated

Patches

  • No vendor patch applies -- the technique abuses the legitimate, by-design OAuth 2.0 Device Authorization Grant (RFC 8628) rather than exploiting a software vulnerability

Immediate actions

  • Block or restrict the OAuth 2.0 Device Authorization Grant flow tenant-wide via Microsoft Entra Conditional Access authentication-flow policies unless a documented business need exists
  • Revoke sign-in sessions and refresh tokens (revokeSignInSessions) for any account suspected of device-code phishing compromise
  • Audit and remove unauthorized inbox rules that auto-forward, auto-delete, or hide mail
  • Review and remove unrecognized/unauthorized device registrations tied to potentially compromised accounts to invalidate rogue Primary Refresh Tokens
  • Block known ARToken/EvilTokens infrastructure at email gateway and perimeter: pamconj.com and subdomains, and flag traffic to identified Railway.com and HZ Hosting IP ranges

Workarounds

  • Disable the device-code authentication flow tenant-wide, or restrict it to named trusted network locations, via Conditional Access 'block authentication flows' policies
  • Enable and alert on Microsoft Graph API activity for MailItemsAccess and mailbox-rule creation events
  • Treat anchor text pointing to sharepoint.com as untrusted if the underlying href/redirect target does not resolve to the organization's own tenant

Longer-term hardening

  • Deploy phishing-resistant authentication (FIDO2 security keys, Microsoft Authenticator passkeys) in place of device-code/OTP-based sign-in flows
  • Implement Continuous Access Evaluation and token/device binding for Microsoft Graph and Exchange Online sessions
  • Monitor Microsoft Entra ID sign-in logs for device-code authentications correlated with error code 50199 and anomalous source ASNs (Railway.com, HZ Hosting)
  • Establish mandatory out-of-band verification for vendor invoice/payment-detail change requests originating by email
  • Deliver targeted user-awareness training on device-code phishing prompts and vendor-impersonation BEC lures for finance, HR, logistics, and accounts-payable staff

Timeline of ARToken PhaaS Platform Exposes EvilTokens-Affiliated

  • Microsoft later assesses that Storm-2372, a suspected Russia-aligned actor, began related (but attributionally distinct) device-code phishing operations against government, NGO, and critical-industry targets across Europe, North America, Africa, and the Middle East around this time.
  • Microsoft publishes its first widely-cited advisory on device-code phishing, documenting Storm-2372's abuse of the OAuth 2.0 Device Authorization Grant flow against Microsoft 365 accounts.
  • EvilTokens device-code phishing landing pages begin circulating in the wild, per Sekoia's TDR team, marking the emergence of the turnkey PhaaS kit that ARToken later becomes an affiliate of.
  • Sekoia's Threat Detection & Research team publishes a two-part analysis of the EvilTokens PhaaS kit, documenting roughly 500 Cloudflare Workers domains and 1,000+ phishing pages tied to the operation.
  • Follow-on reporting (Cloud Security Alliance, The Hacker News) documents device-code phishing having hit 340+ Microsoft 365 organizations across five countries via OAuth abuse.
  • Microsoft Threat Intelligence publishes an analysis of an AI-enabled device-code phishing campaign, detailing Railway.com/Vercel/AWS Lambda redirector infrastructure, PRT/device-registration persistence, and Microsoft Graph reconnaissance and email-collection activity.
  • Push Security reports a 37-fold year-over-year surge in device-code phishing attacks, identifying at least 11 distinct phishing kits offering the technique commercially.
  • Cisco Talos researcher Michael Kelley discovers and publishes analysis of ARToken, a more mature EvilTokens-affiliated operator panel with 80+ API endpoints and a seven-layer anti-analysis system, tied to an invoice-themed BEC campaign against a U.S. life-sciences company impersonating a real Wisconsin-based vendor.
  • The documented ARToken operator panel goes dark shortly after Talos's publication and is assessed to have likely relocated to new infrastructure.
  • BleepingComputer and multiple other outlets publish public reporting summarizing the ARToken/EvilTokens findings, prompting this hunt (TL-2026-1107).

Sources cited for ARToken PhaaS Platform Exposes EvilTokens-Affiliated

Threats related to ARToken PhaaS Platform Exposes EvilTokens-Affiliated

Detection coverage for TL-2026-1107

As of 2026-07-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1107 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats