# ARToken PhaaS Platform Exposes EvilTokens-Affiliated Microsoft 365 Device Code Phishing Toolkit

> Cisco Talos discovered ARToken, a phishing-as-a-service (PhaaS) operator panel affiliated with the EvilTokens platform, exposing a React-based dashboard with 80+ API endpoints used to abuse Microsoft's OAuth 2.0 Device Authorization Grant flow, steal Microsoft 365 access tokens and Primary Refresh Tokens (PRTs), and run full business email compromise (BEC) operations against Outlook, SharePoint, and OneDrive.

- **Published:** 2026-07-05T00:00:00Z
- **Last reviewed:** 2026-07-05T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1107
- **ID:** TL-2026-1107
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** EvilTokens
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ARToken is a phishing-as-a-service (PhaaS) operator panel identified by Cisco Talos researcher Michael Kelley that operates as a paid affiliate of EvilTokens, a device-code phishing kit first documented by Sekoia's Threat Detection & Research (TDR) team in March 2026 and separately analyzed by Microsoft Threat Intelligence in April 2026. ARToken shares an identical API contract, backend commands, and deployment model with EvilTokens, but Talos assesses it as a more mature, more polished affiliate build with materially stronger anti-analysis capabilities.

The platform abuses Microsoft's legitimate OAuth 2.0 Device Authorization Grant (RFC 8628), a workflow designed for input-constrained devices. Victims are lured (commonly via invoice or document-themed emails referencing a real vendor relationship) into visiting the legitimate microsoft.com/devicelogin page and entering a device code that was actually generated by the attacker's backend via a proxied POST request to Microsoft's device authorization endpoint (mirroring the EvilTokens `POST /api/device/start` call pattern, historically paired with a server-side `X-Antibot-Token` 64-character hex header). Because the victim authenticates on Microsoft's real, unmodified login page with their own credentials and MFA, no phishing-detectable credential prompt or MFA challenge is ever shown to the victim -- the attacker's polling backend simply receives the resulting access and refresh tokens once the user approves the code. Operators then escalate the stolen token into a Primary Refresh Token (PRT) by registering a new device against the compromised identity, granting persistent access that survives password resets and refresh-token revocation attempts that don't also address the rogue device object.

The ARToken panel itself is a React single-page application exposing over 80 REST API endpoints covering device-code initiation, PRT setup/refresh/renewal/reacquisition (even after expiry), full Outlook mailbox access (read, send-as, attachment download), hidden inbox-rule creation for auto-forward/auto-delete, cross-mailbox keyword monitoring, and SharePoint/OneDrive file browsing and exfiltration through look-alike, attacker-hosted tenant workspaces linked from anchor text that visually points to legitimate sharepoint.com URLs. A companion product, "Portal Browser," is sold separately for a $500 lifetime fee as a standalone session-hijacking browser. EvilTokens/ARToken access is commercialized at $1,500 setup plus $500/month, marketed and sold through Telegram-based sales channels, consistent with the broader Malware/Phishing-as-a-Service economy.

Talos's flagship case study involved an invoice-themed lure sent to a U.S. life-sciences company, spoofing the accounts-payable contact at a real Wisconsin-based plumbing and fire-protection vendor with which the target had a genuine business relationship -- exploiting the fact that accounts-payable staff are conditioned to respond to outstanding-invoice inquiries. Near-identical lure emails were observed four minutes apart, consistent with automated, AI-assisted lure generation. EvilTokens' second-stage tooling chains Groq-hosted Llama models for automated financial-exposure scoring of compromised mailboxes and GPT-4o-mini for email translation/localization, generating three tailored BEC scenarios per compromised mailbox -- turning simple token theft into what Talos and other researchers describe as "a complete BEC operations environment" rather than a conventional phishing kit.

Defense evasion is materially upgraded versus earlier EvilTokens builds: ARToken implements a seven-layer anti-analysis screening chain (browser/automation fingerprinting, headless-browser and crawler detection, mouse-movement/touch validation, and timing checks) combined with client-side XOR-encrypted payload delivery, superseding the simpler server-side X-Antibot-Token check used in the base EvilTokens kit. Infrastructure is built almost entirely on abused legitimate cloud platforms -- Cloudflare Workers (*.workers.dev), Vercel (*.vercel.app), AWS Lambda, and Railway.com-hosted backend automation nodes -- to blend malicious traffic in with normal SaaS activity and frustrate domain-reputation-based blocking. By the time of Microsoft's April 2026 publication, the broader EvilTokens ecosystem (which ARToken affiliates from) was tracked operating roughly 500 Cloudflare Workers domains and over 1,000-2,000 individual phishing pages, with Microsoft observing 10-15 distinct new campaigns launching daily, each hitting hundreds of organizations with unique, pattern-detection-evading payloads.

This campaign follows and technically resembles the device-code phishing technique first mass-documented by Microsoft against Storm-2372, a suspected Russia-aligned actor Microsoft assessed with moderate confidence, active since around August 2024 against government, NGO, IT/technology, defense, telecom, health, higher-education, and energy targets across Europe, North America, Africa, and the Middle East. However, Talos explicitly notes it has not fully determined the breadth of ARToken's usage or the identity of any specific threat actor(s) operating behind this affiliate panel; EvilTokens/ARToken is a commercially sold, criminal PhaaS product used by multiple financially motivated affiliates for BEC and invoice fraud, and is treated here as attributionally distinct from -- though tactically related to -- the earlier, differently-motivated Storm-2372 campaign. Confirmed ARToken/EvilTokens targeting includes finance, HR, logistics, life-sciences, and public-sector organizations across multiple regions. The specific ARToken panel documented by Talos went dark shortly after publication and is assessed to have likely relocated to new infrastructure.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1566 Phishing
- T1204 User Execution
- T1098 Account Manipulation
- T1137 Office Application Startup
- T1078 Valid Accounts
- T1556 Modify Authentication Process
- T1550 Use Alternate Authentication Material
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1684.001 Impersonation
- T1528 Steal Application Access Token
- T1087 Account Discovery
- T1526 Cloud Service Discovery
- T1550 Use Alternate Authentication Material
- T1114 Email Collection
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1102 Web Service
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [ARToken PhaaS Exposes EvilTokens Microsoft 365 Phishing Toolkit](https://www.bleepingcomputer.com/news/security/artoken-phaas-exposes-eviltokens-microsoft-365-phishing-toolkit/)
- [ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365](https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/)
- [EvilTokens device-code phishing kit totally more evil than we all thought](https://www.theregister.com/cyber-crime/2026/07/01/eviltokens-device-code-phishing-kit-totally-more-evil-than-we-all-thought/5265409)
- [Cisco Talos Exposes ARToken Microsoft 365 Phishing Kit](https://www.esecurityplanet.com/threats/cisco-talos-exposes-artoken-microsoft-365-phishing-kit/)
- [The ARToken phishing panel targets Microsoft 365 accounts](https://www.helpnetsecurity.com/2026/07/01/artoken-phishing-panel-microsoft-365-accounts/)
- [This phishing kit looks more like BEC-as-a-service](https://cyberscoop.com/artoken-bec-platform-cisco-talos/)
- [EvilTokens-Linked ARToken Panel Exposes 80+ APIs for Microsoft 365 Token Theft](https://gbhackers.com/eviltokens-linked-artoken-panel/)
- [Microsoft 365 Phishing Panel Uses OAuth Device Code Flow to Capture Tokens and Persist Access](https://cybersecuritynews.com/microsoft-365-phishing-panel-uses-oauth-device-code-flow/)
- [New widespread EvilTokens kit: device code phishing as-a-service (Part 1)](https://www.sekoia.com/blog/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1)
- [Inside an AI-enabled device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2026/04/06/ai-enabled-device-code-phishing-campaign-april-2026/)
- [Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse](https://thehackernews.com/2026/03/device-code-phishing-hits-340-microsoft.html)
- [Analyzing the rise in device code phishing attacks in 2026](https://pushsecurity.com/blog/device-code-phishing/)
- [Storm-2372 conducts device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)
- [OAuth Device Code Phishing: 37x Surge in Enterprise ATO](https://labs.cloudsecurityalliance.org/research/csa-research-note-oauth-device-code-phishing-surge-20260405/)
- [The ARToken Panel: How a React-Based Phishing Kit Is Hijacking Microsoft 365 Sessions via Device Code Attacks](https://windowsnews.ai/article/artoken-panel-how-a-react-based-phishing-kit-is-hijacking-microsoft-365-sessions-via-device-code-att.432822)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1107