ARToken PhaaS Platform Exposes EvilTokens-Affiliated Microsoft 365 Device Code Phishing Toolkit
ARToken PhaaS Platform Exposes EvilTokens-Affiliated (TL-2026-1107), also tracked as ARToken Panel, is a high-severity phishing campaign, first published 2026-07-05. It is attributed to ARToken PhaaS affiliates with low confidence, affects Microsoft Microsoft 365 (Entra ID / Azure AD OAuth 2.0 Device, maps to 23 MITRE ATT&CK techniques (T1027, T1071, T1078), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-1107
- Threat ID
- TL-2026-1107
- Also known as
- ARToken Panel, EvilTokens PhaaS, Device Code Phishing Kit
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-07-05
- Last reviewed
- 2026-07-05
- Attribution
- ARToken PhaaS affiliates
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, humanresources, logistics, lifesciences, publicsector, accountspayable, hospitality
- Target regions
- North America, Europe, Middle East, Asia-Pacific, Africa
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in ARToken PhaaS Platform Exposes EvilTokens-Affiliated
Malware and tooling: ARToken, EvilTokens, ARToken Panel, GPT-4o-mini, Groq-hosted Llama models, Portal Browser
Cisco Talos discovered ARToken, a phishing-as-a-service (PhaaS) operator panel affiliated with the EvilTokens platform, exposing a React-based dashboard with 80+ API endpoints used to abuse Microsoft's OAuth 2.0 Device Authorization Grant flow, steal Microsoft 365 access tokens and Primary Refresh Tokens (PRTs), and run full business email compromise (BEC) operations against Outlook, SharePoint, and OneDrive.
How ARToken PhaaS Platform Exposes EvilTokens-Affiliated works
ARToken is a phishing-as-a-service (PhaaS) operator panel identified by Cisco Talos researcher Michael Kelley that operates as a paid affiliate of EvilTokens, a device-code phishing kit first documented by Sekoia's Threat Detection & Research (TDR) team in March 2026 and separately analyzed by Microsoft Threat Intelligence in April 2026. ARToken shares an identical API contract, backend commands, and deployment model with EvilTokens, but Talos assesses it as a more mature, more polished affiliate build with materially stronger anti-analysis capabilities.
The platform abuses Microsoft's legitimate OAuth 2.0 Device Authorization Grant (RFC 8628), a workflow designed for input-constrained devices. Victims are lured (commonly via invoice or document-themed emails referencing a real vendor relationship) into visiting the legitimate microsoft.com/devicelogin page and entering a device code that was actually generated by the attacker's backend via a proxied POST request to Microsoft's device authorization endpoint (mirroring the EvilTokens `POST /api/device/start` call pattern, historically paired with a server-side `X-Antibot-Token` 64-character hex header). Because the victim authenticates on Microsoft's real, unmodified login page with their own credentials and MFA, no phishing-detectable credential prompt or MFA challenge is ever shown to the victim -- the attacker's polling backend simply receives the resulting access and refresh tokens once the user approves the code. Operators then escalate the stolen token into a Primary Refresh Token (PRT) by registering a new device against the compromised identity, granting persistent access that survives password resets and refresh-token revocation attempts that don't also address the rogue device object.
The ARToken panel itself is a React single-page application exposing over 80 REST API endpoints covering device-code initiation, PRT setup/refresh/renewal/reacquisition (even after expiry), full Outlook mailbox access (read, send-as, attachment download), hidden inbox-rule creation for auto-forward/auto-delete, cross-mailbox keyword monitoring, and SharePoint/OneDrive file browsing and exfiltration through look-alike, attacker-hosted tenant workspaces linked from anchor text that visually points to legitimate sharepoint.com URLs. A companion product, "Portal Browser," is sold separately for a $500 lifetime fee as a standalone session-hijacking browser. EvilTokens/ARToken access is commercialized at $1,500 setup plus $500/month, marketed and sold through Telegram-based sales channels, consistent with the broader Malware/Phishing-as-a-Service economy.
Talos's flagship case study involved an invoice-themed lure sent to a U.S. life-sciences company, spoofing the accounts-payable contact at a real Wisconsin-based plumbing and fire-protection vendor with which the target had a genuine business relationship -- exploiting the fact that accounts-payable staff are conditioned to respond to outstanding-invoice inquiries. Near-identical lure emails were observed four minutes apart, consistent with automated, AI-assisted lure generation. EvilTokens' second-stage tooling chains Groq-hosted Llama models for automated financial-exposure scoring of compromised mailboxes and GPT-4o-mini for email translation/localization, generating three tailored BEC scenarios per compromised mailbox -- turning simple token theft into what Talos and other researchers describe as "a complete BEC operations environment" rather than a conventional phishing kit.
Defense evasion is materially upgraded versus earlier EvilTokens builds: ARToken implements a seven-layer anti-analysis screening chain (browser/automation fingerprinting, headless-browser and crawler detection, mouse-movement/touch validation, and timing checks) combined with client-side XOR-encrypted payload delivery, superseding the simpler server-side X-Antibot-Token check used in the base EvilTokens kit. Infrastructure is built almost entirely on abused legitimate cloud platforms -- Cloudflare Workers (*.workers.dev), Vercel (*.vercel.app), AWS Lambda, and Railway.com-hosted backend automation nodes -- to blend malicious traffic in with normal SaaS activity and frustrate domain-reputation-based blocking. By the time of Microsoft's April 2026 publication, the broader EvilTokens ecosystem (which ARToken affiliates from) was tracked operating roughly 500 Cloudflare Workers domains and over 1,000-2,000 individual phishing pages, with Microsoft observing 10-15 distinct new campaigns launching daily, each hitting hundreds of organizations with unique, pattern-detection-evading payloads.
This campaign follows and technically resembles the device-code phishing technique first mass-documented by Microsoft against Storm-2372, a suspected Russia-aligned actor Microsoft assessed with moderate confidence, active since around August 2024 against government, NGO, IT/technology, defense, telecom, health, higher-education, and energy targets across Europe, North America, Africa, and the Middle East. However, Talos explicitly notes it has not fully determined the breadth of ARToken's usage or the identity of any specific threat actor(s) operating behind this affiliate panel; EvilTokens/ARToken is a commercially sold, criminal PhaaS product used by multiple financially motivated affiliates for BEC and invoice fraud, and is treated here as attributionally distinct from -- though tactically related to -- the earlier, differently-motivated Storm-2372 campaign. Confirmed ARToken/EvilTokens targeting includes finance, HR, logistics, life-sciences, and public-sector organizations across multiple regions. The specific ARToken panel documented by Talos went dark shortly after publication and is assessed to have likely relocated to new infrastructure.
MITRE ATT&CK techniques used in TL-2026-1107
Defense Evasion
T1027 Obfuscated Files or Information; T1497 Virtualization/Sandbox Evasion
Command and Control
T1071 Application Layer Protocol; T1102 Web Service
Privilege Escalation
Discovery
T1087 Account Discovery; T1526 Cloud Service Discovery
Persistence
T1098 Account Manipulation; T1137 Office Application Startup
Collection
T1114 Email Collection; T1119 Automated Collection; T1213 Data from Information Repositories
Execution
Credential Access
T1528 Steal Application Access Token
lateral-movement
T1550 Use Alternate Authentication Material
Lateral Movement
T1550 Use Alternate Authentication Material
defense-impairment
T1556 Modify Authentication Process
Initial Access
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1583 Acquire Infrastructure; T1588 Obtain Capabilities
Reconnaissance
T1589 Gather Victim Identity Information
Impact
stealth
Affected products and versions in ARToken PhaaS Platform Exposes EvilTokens-Affiliated
- Microsoft — Microsoft 365 (Entra ID / Azure AD OAuth 2.0 Device Authorization Grant)
Vulnerable versions: all Microsoft 365 / Entra ID tenants with device-code authentication flow enabled and unrestricted
Fixed in: N/A - abuse of legitimate protocol; mitigated only via Conditional Access policies restricting/blocking the device-code authentication flow - Microsoft — SharePoint Online / OneDrive
Vulnerable versions: tenants accessible via compromised Microsoft 365 tokens/PRTs
Fixed in: N/A - downstream exposure of compromised identity, not a SharePoint/OneDrive vulnerability
Remediation for ARToken PhaaS Platform Exposes EvilTokens-Affiliated
Patches
- No vendor patch applies -- the technique abuses the legitimate, by-design OAuth 2.0 Device Authorization Grant (RFC 8628) rather than exploiting a software vulnerability
Immediate actions
- Block or restrict the OAuth 2.0 Device Authorization Grant flow tenant-wide via Microsoft Entra Conditional Access authentication-flow policies unless a documented business need exists
- Revoke sign-in sessions and refresh tokens (revokeSignInSessions) for any account suspected of device-code phishing compromise
- Audit and remove unauthorized inbox rules that auto-forward, auto-delete, or hide mail
- Review and remove unrecognized/unauthorized device registrations tied to potentially compromised accounts to invalidate rogue Primary Refresh Tokens
- Block known ARToken/EvilTokens infrastructure at email gateway and perimeter: pamconj.com and subdomains, and flag traffic to identified Railway.com and HZ Hosting IP ranges
Workarounds
- Disable the device-code authentication flow tenant-wide, or restrict it to named trusted network locations, via Conditional Access 'block authentication flows' policies
- Enable and alert on Microsoft Graph API activity for MailItemsAccess and mailbox-rule creation events
- Treat anchor text pointing to sharepoint.com as untrusted if the underlying href/redirect target does not resolve to the organization's own tenant
Longer-term hardening
- Deploy phishing-resistant authentication (FIDO2 security keys, Microsoft Authenticator passkeys) in place of device-code/OTP-based sign-in flows
- Implement Continuous Access Evaluation and token/device binding for Microsoft Graph and Exchange Online sessions
- Monitor Microsoft Entra ID sign-in logs for device-code authentications correlated with error code 50199 and anomalous source ASNs (Railway.com, HZ Hosting)
- Establish mandatory out-of-band verification for vendor invoice/payment-detail change requests originating by email
- Deliver targeted user-awareness training on device-code phishing prompts and vendor-impersonation BEC lures for finance, HR, logistics, and accounts-payable staff
Timeline of ARToken PhaaS Platform Exposes EvilTokens-Affiliated
- Microsoft later assesses that Storm-2372, a suspected Russia-aligned actor, began related (but attributionally distinct) device-code phishing operations against government, NGO, and critical-industry targets across Europe, North America, Africa, and the Middle East around this time.
- Microsoft publishes its first widely-cited advisory on device-code phishing, documenting Storm-2372's abuse of the OAuth 2.0 Device Authorization Grant flow against Microsoft 365 accounts.
- EvilTokens device-code phishing landing pages begin circulating in the wild, per Sekoia's TDR team, marking the emergence of the turnkey PhaaS kit that ARToken later becomes an affiliate of.
- Sekoia's Threat Detection & Research team publishes a two-part analysis of the EvilTokens PhaaS kit, documenting roughly 500 Cloudflare Workers domains and 1,000+ phishing pages tied to the operation.
- Follow-on reporting (Cloud Security Alliance, The Hacker News) documents device-code phishing having hit 340+ Microsoft 365 organizations across five countries via OAuth abuse.
- Microsoft Threat Intelligence publishes an analysis of an AI-enabled device-code phishing campaign, detailing Railway.com/Vercel/AWS Lambda redirector infrastructure, PRT/device-registration persistence, and Microsoft Graph reconnaissance and email-collection activity.
- Push Security reports a 37-fold year-over-year surge in device-code phishing attacks, identifying at least 11 distinct phishing kits offering the technique commercially.
- Cisco Talos researcher Michael Kelley discovers and publishes analysis of ARToken, a more mature EvilTokens-affiliated operator panel with 80+ API endpoints and a seven-layer anti-analysis system, tied to an invoice-themed BEC campaign against a U.S. life-sciences company impersonating a real Wisconsin-based vendor.
- The documented ARToken operator panel goes dark shortly after Talos's publication and is assessed to have likely relocated to new infrastructure.
- BleepingComputer and multiple other outlets publish public reporting summarizing the ARToken/EvilTokens findings, prompting this hunt (TL-2026-1107).
Sources cited for ARToken PhaaS Platform Exposes EvilTokens-Affiliated
- ARToken PhaaS Exposes EvilTokens Microsoft 365 Phishing Toolkit
- ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365
- EvilTokens device-code phishing kit totally more evil than we all thought
- Cisco Talos Exposes ARToken Microsoft 365 Phishing Kit
- The ARToken phishing panel targets Microsoft 365 accounts
- This phishing kit looks more like BEC-as-a-service
- EvilTokens-Linked ARToken Panel Exposes 80+ APIs for Microsoft 365 Token Theft
- Microsoft 365 Phishing Panel Uses OAuth Device Code Flow to Capture Tokens and Persist Access
- New widespread EvilTokens kit: device code phishing as-a-service (Part 1)
- Inside an AI-enabled device code phishing campaign
- Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse
- Analyzing the rise in device code phishing attacks in 2026
- Storm-2372 conducts device code phishing campaign
- OAuth Device Code Phishing: 37x Surge in Enterprise ATO
- The ARToken Panel: How a React-Based Phishing Kit Is Hijacking Microsoft 365 Sessions via Device Code Attacks
Threats related to ARToken PhaaS Platform Exposes EvilTokens-Affiliated
- EvilTokens/ARToken Device-Code Phishing Kit Bypasses MFA to Compromise Microsoft 365 Accounts
- Device Code Phishing: OAuth Device Authorization Grant Abuse Bypasses All MFA Forms, Including Passkeys
- Forg365: Telegram-Distributed Phishing-as-a-Service Abusing Microsoft Device-Code Flow and AiTM to Hijack Microsoft 365/Entra Sessions
- Microsoft 365 Device Code Phishing Campaign Abusing the OAuth 2.0 Device Authorization Grant Flow (EvilTokens PhaaS)
- Three PhaaS Kits (Sneaky 2FA, EvilTokens, EvilProxy) Targeting US Organizations to Steal M365 Credentials and Session Tokens
- ARToken Phishing Panel Abuses Microsoft OAuth Device Code Flow to Hijack Microsoft 365 Accounts (EvilTokens PhaaS)
Detection coverage for TL-2026-1107
As of 2026-07-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1107 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.