EvilTokens/ARToken Device-Code Phishing Kit Bypasses MFA to Compromise Microsoft 365 Accounts

EvilTokens/ARToken Device-Code Phishing Kit Bypasses MFA to (TL-2026-1128), also tracked as ARToken Panel, is a high-severity phishing campaign, first published 2026-07-05. It is attributed to EvilTokens PhaaS Operators with low confidence, affects Microsoft Microsoft 365 / Entra ID (OAuth 2.0 Device Authorization, maps to 34 MITRE ATT&CK techniques (T1020, T1027, T1036), and is covered by 9 detection rules and 27 indicators of compromise.

Key facts for TL-2026-1128

Threat ID
TL-2026-1128
Also known as
ARToken Panel, AI-Enabled Device Code Phishing Campaign
Severity
HIGH
Status
ACTIVE
Category
PHISHING
First published
2026-07-05
Last reviewed
2026-07-05
Attribution
EvilTokens PhaaS Operators
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
life sciences, finance, human resources, logistics, accounts payable, public sector
Target regions
united states of america, canada, france, australia, india, switzerland, united arab emirates
Detection rules
9
Indicators of compromise
27

Malware and tooling in EvilTokens/ARToken Device-Code Phishing Kit Bypasses MFA to

Malware and tooling: ARToken Panel, ARToken device-code broker API, EvilTokens, Kali365

EvilTokens is a Telegram-sold phishing-as-a-service (PhaaS) kit that abuses Microsoft's OAuth 2.0 Device Authorization Grant flow to bypass MFA and hijack Microsoft 365 accounts; Cisco Talos exposed an affiliate panel called ARToken sharing identical API contracts and infrastructure with EvilTokens, revealing a seven-layer anti-analysis system, Primary Refresh Token (PRT) persistence via Windows Authentication Broker abuse, and a full business-email-compromise (BEC) operations environment. Microsoft observed 10-15 distinct campaigns launching daily since March 15, 2026, compromising hundreds of organizations per day, while Sekoia documented 340+ Microsoft 365 organizations compromised across seven countries.

How EvilTokens/ARToken Device-Code Phishing Kit Bypasses MFA to works

EvilTokens is a turnkey, Telegram-distributed phishing-as-a-service (PhaaS) kit first documented by Sekoia's Threat Detection & Research team in March 2026 (pages circulating since mid-February 2026), sold for roughly $1,500 upfront plus a recurring monthly fee. Rather than harvesting passwords, the kit abuses Microsoft's legitimate OAuth 2.0 Device Authorization Grant flow: the attacker-controlled backend initiates a genuine device-code authentication request against Microsoft, then delivers the resulting code to the victim through a phishing lure. When the victim enters the code on the real microsoft.com/devicelogin page, they unknowingly authorize the attacker's session, and Microsoft issues a valid access and refresh token directly to the attacker's backend — silently defeating MFA without ever presenting a spoofed login form.

On July 1, 2026, Cisco Talos (researcher Michael Kelley) disclosed 'ARToken,' a React-based operator panel that functions as an EvilTokens affiliate/customer, sharing identical API contracts (an identical POST /api/device/start call) and infrastructure patterns. ARToken escalates initial device-code access into a Primary Refresh Token (PRT) by sending a non-standard clientMode:"broker" parameter that triggers Microsoft's Windows Authentication Broker (WAM) flow — a technique that keeps working even after the victim resets their password. The panel exposes more than 80 API endpoints spanning device-code initiation, PRT setup/refresh/renewal/cookie management, token export/import between operators, full Outlook mailbox read/send-as-victim access, automated malicious inbox-rule creation, cross-mailbox keyword monitoring, mass-BCC sending, and SharePoint/OneDrive browsing, upload, download, and permission management. AI/LLM-driven workflows score harvested mailboxes for financial exposure, draft BEC follow-up messages, and translate stolen email threads for multilingual operators — Talos assessed the platform as 'more mature than a simple device code phishing kit... a complete BEC operations environment.'

Evasion is handled by a seven-layer client-side anti-analysis system that fingerprints the browser to screen out headless browsers, automation frameworks, and crawlers; waits for genuine mouse movement or a touch event; imposes roughly a one-second activation delay; and only then unpacks an XOR-encrypted phishing payload in the browser, correlating the session via a LocalStorage key (artoken_jwt). This supersedes an earlier, simpler server-side X-Antibot-Token (64-character hex) header used by prior EvilTokens variants.

Campaigns use highly targeted, AI-generated, geo-aware vendor-impersonation lures — in one case-study Talos examined, an outstanding-invoice email spoofing a real Wisconsin plumbing-and-fire-protection contractor was sent to an accounts-payable contact at a U.S. life-sciences company; the visible link text displayed the vendor's genuine domain while the underlying href pointed to a look-alike SharePoint tenant hosted on an attacker-controlled Microsoft 365 workspace (resolving to legitimate sharepoint.com infrastructure to evade filters), and the message failed SPF, DKIM, and DMARC. Targeting concentrates on finance, HR, logistics, life-sciences, and public-sector accounts-payable staff.

A related but distinct April 2026 Microsoft-documented 'AI-enabled device code phishing' campaign shows the technique's broader commoditization: thousands of unique polling nodes hosted on Railway.com ran Node.js backend automation that generated device codes dynamically at the final redirect stage (defeating the standard 15-minute code expiry), used browser-in-the-browser fake verification prompts, hijacked the clipboard via navigator.clipboard.writeText to auto-paste the code, and polled a /state endpoint via checkStatus() every 3-5 seconds. Reconnaissance queried Microsoft's GetCredentialType endpoint 10-15 days before phishing delivery to validate target accounts at scale. Post-compromise, threat actors registered new Entra ID devices to mint PRTs within 10 minutes, then created malicious inbox rules and used Microsoft Graph to map organizational structure and locate high-value (financial/executive) targets.

Microsoft's telemetry shows 10-15 distinct device-code phishing campaigns launching every 24 hours since March 15, 2026, each targeting hundreds of organizations with unique payloads, and hundreds of organizations compromised daily. Sekoia separately reported 340+ Microsoft 365 organizations compromised across the United States, Canada, France, Australia, India, Switzerland, and the UAE, and catalogued roughly 500 Cloudflare Workers domains hosting 1,000-2,000+ individual phishing pages tied to the EvilTokens ecosystem. A competing PhaaS kit, Kali365, first seen in April 2026 and distributed via Telegram, uses the same OAuth device-code abuse technique and was the subject of an FBI/IC3 public service announcement (PSA260521) in May 2026. Push Security separately reported that device-code phishing techniques have surged roughly 37-fold year-over-year, with at least 11 distinct phishing kits now offering the capability.

The underlying technique itself is not new: Microsoft first disclosed the suspected Russia-aligned nation-state actor Storm-2372 using device-code phishing since August 2024 against government, NGO, IT, defense, telecom, health, education, and energy targets across Europe, North America, Africa, and the Middle East, with Volexity separately linking additional Russia-affiliated clusters UTA0304 and UTA0307 to the same technique. EvilTokens/ARToken represents the commoditization of that nation-state tradecraft into a financially motivated, criminal PhaaS/BEC-as-a-service offering with no confirmed nation-state attribution of its own.

MITRE ATT&CK techniques used in TL-2026-1128

Exfiltration

T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1497 Virtualization/Sandbox Evasion

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Discovery

T1069 Permission Groups Discovery; T1087 Account Discovery; T1526 Cloud Service Discovery

Command and Control

T1071 Application Layer Protocol; T1102 Web Service; T1573 Encrypted Channel

Initial Access

T1078 Valid Accounts; T1566 Phishing

Persistence

T1098 Account Manipulation; T1137 Office Application Startup

Credential Access

T1110 Brute Force; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie

Collection

T1114 Email Collection; T1119 Automated Collection; T1213 Data from Information Repositories

lateral-movement

T1550 Use Alternate Authentication Material

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities

Reconnaissance

T1589 Gather Victim Identity Information; T1591 Gather Victim Org Information; T1598 Phishing for Information

Impact

T1657 Financial Theft

stealth

T1684.001 Impersonation

Affected products and versions in EvilTokens/ARToken Device-Code Phishing Kit Bypasses MFA to

  • Microsoft — Microsoft 365 / Entra ID (OAuth 2.0 Device Authorization Grant flow)
    Vulnerable versions: Any Entra ID tenant with the OAuth 2.0 device authorization grant flow enabled without Conditional Access restriction
    Fixed in: N/A - technique abuse, not a software vulnerability; mitigated via Conditional Access policies restricting/blocking the device code flow and requiring phishing-resistant MFA

Remediation for EvilTokens/ARToken Device-Code Phishing Kit Bypasses MFA to

Patches

  • No vendor patch applies — this is abuse of a legitimate OAuth authentication flow, not a software vulnerability

Immediate actions

  • Block or restrict the OAuth 2.0 Device Authorization Grant flow via Conditional Access 'Authentication Flows' policies for users and applications that do not require it
  • Revoke refresh and session tokens (revokeSigninSessions) for any account with a suspected device-code-phishing compromise, and disable the account pending investigation
  • Hunt for and remove malicious Outlook inbox rules created after suspicious device-code sign-ins, especially rules with special-character or randomized names
  • Block known ARToken/EvilTokens infrastructure (pamconj.com and subdomains, identified Cloudflare Workers phishing domains, Railway.com/HZ Hosting IP ranges) at the email gateway and web proxy

Workarounds

  • Restrict device-code flow to specific trusted device/application IDs via Conditional Access policy rather than disabling it tenant-wide
  • Reduce access-token lifetimes and enforce step-up re-authentication for high-risk sessions, since standard session revocation only invalidates refresh tokens and can leave access tokens valid for up to an hour

Longer-term hardening

  • Require phishing-resistant MFA (FIDO2 security keys, Windows Hello for Business, Authenticator with passkeys) instead of OTP/push-based MFA
  • Disable legacy authentication protocols across Microsoft 365 tenants
  • Deploy Defender for Office 365 predelivery protection and Defender for Identity anomalous device-code-authentication detections
  • Implement Entra ID Protection continuous access evaluation and sign-in risk policies keyed on anonymizedIPAddress and investigationsThreatIntelligence risk events
  • Establish an out-of-band vendor verification workflow for invoice and payment-detail change requests to blunt BEC follow-on fraud

Timeline of EvilTokens/ARToken Device-Code Phishing Kit Bypasses MFA to

  • Microsoft first observes Storm-2372, a suspected Russia-aligned nation-state actor, conducting device-code phishing campaigns against government, NGO, IT, defense, telecom, health, education, and energy targets across Europe, North America, Africa, and the Middle East, establishing the technique later commoditized by EvilTokens/ARToken.
  • Microsoft Security Blog publicly discloses the Storm-2372 device-code phishing campaign; Volexity separately links Russia-affiliated clusters UTA0304 and UTA0307 to the same technique.
  • EvilTokens phishing pages begin circulating among cybercriminal affiliates specializing in adversary-in-the-middle phishing and business email compromise, per Sekoia telemetry.
  • Microsoft begins observing 10-15 distinct device-code phishing campaigns launching every 24 hours, each targeting hundreds of organizations with unique payloads.
  • Public reporting citing Sekoia research documents EvilTokens campaigns compromising 340+ Microsoft 365 organizations across the United States, Canada, France, Australia, India, Switzerland, and the UAE.
  • Sekoia's Threat Detection & Research team publishes the first public documentation of EvilTokens as a turnkey, Telegram-sold device-code PhaaS kit with AI-powered BEC tooling, priced at roughly $1,500 upfront plus a monthly fee.
  • Microsoft Security Blog discloses a related AI-enabled device-code phishing campaign using Railway.com-hosted polling nodes, dynamic device-code generation, browser-in-the-browser lures, and clipboard hijacking, with Primary Refresh Token registration occurring within 10 minutes of compromise.
  • The competing Kali365 device-code PhaaS kit is first observed being distributed via Telegram, using the same OAuth device-code abuse technique.
  • The FBI/IC3 issues Public Service Announcement PSA260521 warning organizations about the Kali365 phishing-as-a-service kit hijacking Microsoft 365 access tokens via OAuth device-code abuse.
  • Cisco Talos publishes research exposing 'ARToken,' an EvilTokens affiliate panel sharing identical API contracts (POST /api/device/start, PRT broker-mode parameters) and infrastructure (pamconj.com), revealing a seven-layer anti-analysis evasion system and a full BEC operations environment with 80+ API endpoints before the panel goes offline.

Sources cited for EvilTokens/ARToken Device-Code Phishing Kit Bypasses MFA to

Threats related to EvilTokens/ARToken Device-Code Phishing Kit Bypasses MFA to

Detection coverage for TL-2026-1128

As of 2026-07-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1128 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats