# EvilTokens/ARToken Device-Code Phishing Kit Bypasses MFA to Compromise Microsoft 365 Accounts

> EvilTokens is a Telegram-sold phishing-as-a-service (PhaaS) kit that abuses Microsoft's OAuth 2.0 Device Authorization Grant flow to bypass MFA and hijack Microsoft 365 accounts; Cisco Talos exposed an affiliate panel called ARToken sharing identical API contracts and infrastructure with EvilTokens, revealing a seven-layer anti-analysis system, Primary Refresh Token (PRT) persistence via Windows Authentication Broker abuse, and a full business-email-compromise (BEC) operations environment. Microsoft observed 10-15 distinct campaigns launching daily since March 15, 2026, compromising hundreds of organizations per day, while Sekoia documented 340+ Microsoft 365 organizations compromised across seven countries.

- **Published:** 2026-07-05T00:00:00Z
- **Last reviewed:** 2026-07-05T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1128
- **ID:** TL-2026-1128
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** EvilTokens PhaaS Operators
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

EvilTokens is a turnkey, Telegram-distributed phishing-as-a-service (PhaaS) kit first documented by Sekoia's Threat Detection & Research team in March 2026 (pages circulating since mid-February 2026), sold for roughly $1,500 upfront plus a recurring monthly fee. Rather than harvesting passwords, the kit abuses Microsoft's legitimate OAuth 2.0 Device Authorization Grant flow: the attacker-controlled backend initiates a genuine device-code authentication request against Microsoft, then delivers the resulting code to the victim through a phishing lure. When the victim enters the code on the real microsoft.com/devicelogin page, they unknowingly authorize the attacker's session, and Microsoft issues a valid access and refresh token directly to the attacker's backend — silently defeating MFA without ever presenting a spoofed login form.

On July 1, 2026, Cisco Talos (researcher Michael Kelley) disclosed 'ARToken,' a React-based operator panel that functions as an EvilTokens affiliate/customer, sharing identical API contracts (an identical POST /api/device/start call) and infrastructure patterns. ARToken escalates initial device-code access into a Primary Refresh Token (PRT) by sending a non-standard clientMode:"broker" parameter that triggers Microsoft's Windows Authentication Broker (WAM) flow — a technique that keeps working even after the victim resets their password. The panel exposes more than 80 API endpoints spanning device-code initiation, PRT setup/refresh/renewal/cookie management, token export/import between operators, full Outlook mailbox read/send-as-victim access, automated malicious inbox-rule creation, cross-mailbox keyword monitoring, mass-BCC sending, and SharePoint/OneDrive browsing, upload, download, and permission management. AI/LLM-driven workflows score harvested mailboxes for financial exposure, draft BEC follow-up messages, and translate stolen email threads for multilingual operators — Talos assessed the platform as 'more mature than a simple device code phishing kit... a complete BEC operations environment.'

Evasion is handled by a seven-layer client-side anti-analysis system that fingerprints the browser to screen out headless browsers, automation frameworks, and crawlers; waits for genuine mouse movement or a touch event; imposes roughly a one-second activation delay; and only then unpacks an XOR-encrypted phishing payload in the browser, correlating the session via a LocalStorage key (artoken_jwt). This supersedes an earlier, simpler server-side X-Antibot-Token (64-character hex) header used by prior EvilTokens variants.

Campaigns use highly targeted, AI-generated, geo-aware vendor-impersonation lures — in one case-study Talos examined, an outstanding-invoice email spoofing a real Wisconsin plumbing-and-fire-protection contractor was sent to an accounts-payable contact at a U.S. life-sciences company; the visible link text displayed the vendor's genuine domain while the underlying href pointed to a look-alike SharePoint tenant hosted on an attacker-controlled Microsoft 365 workspace (resolving to legitimate sharepoint.com infrastructure to evade filters), and the message failed SPF, DKIM, and DMARC. Targeting concentrates on finance, HR, logistics, life-sciences, and public-sector accounts-payable staff.

A related but distinct April 2026 Microsoft-documented 'AI-enabled device code phishing' campaign shows the technique's broader commoditization: thousands of unique polling nodes hosted on Railway.com ran Node.js backend automation that generated device codes dynamically at the final redirect stage (defeating the standard 15-minute code expiry), used browser-in-the-browser fake verification prompts, hijacked the clipboard via navigator.clipboard.writeText to auto-paste the code, and polled a /state endpoint via checkStatus() every 3-5 seconds. Reconnaissance queried Microsoft's GetCredentialType endpoint 10-15 days before phishing delivery to validate target accounts at scale. Post-compromise, threat actors registered new Entra ID devices to mint PRTs within 10 minutes, then created malicious inbox rules and used Microsoft Graph to map organizational structure and locate high-value (financial/executive) targets.

Microsoft's telemetry shows 10-15 distinct device-code phishing campaigns launching every 24 hours since March 15, 2026, each targeting hundreds of organizations with unique payloads, and hundreds of organizations compromised daily. Sekoia separately reported 340+ Microsoft 365 organizations compromised across the United States, Canada, France, Australia, India, Switzerland, and the UAE, and catalogued roughly 500 Cloudflare Workers domains hosting 1,000-2,000+ individual phishing pages tied to the EvilTokens ecosystem. A competing PhaaS kit, Kali365, first seen in April 2026 and distributed via Telegram, uses the same OAuth device-code abuse technique and was the subject of an FBI/IC3 public service announcement (PSA260521) in May 2026. Push Security separately reported that device-code phishing techniques have surged roughly 37-fold year-over-year, with at least 11 distinct phishing kits now offering the capability.

The underlying technique itself is not new: Microsoft first disclosed the suspected Russia-aligned nation-state actor Storm-2372 using device-code phishing since August 2024 against government, NGO, IT, defense, telecom, health, education, and energy targets across Europe, North America, Africa, and the Middle East, with Volexity separately linking additional Russia-affiliated clusters UTA0304 and UTA0307 to the same technique. EvilTokens/ARToken represents the commoditization of that nation-state tradecraft into a financially motivated, criminal PhaaS/BEC-as-a-service offering with no confirmed nation-state attribution of its own.

## MITRE ATT&CK

- T1598 Phishing for Information
- T1589 Gather Victim Identity Information
- T1591 Gather Victim Org Information
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1585 Establish Accounts
- T1566 Phishing
- T1078 Valid Accounts
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1098 Account Manipulation
- T1137 Office Application Startup
- T1550 Use Alternate Authentication Material
- T1036 Masquerading
- T1684.001 Impersonation
- T1497 Virtualization/Sandbox Evasion
- T1027 Obfuscated Files or Information
- T1528 Steal Application Access Token
- T1110 Brute Force
- T1539 Steal Web Session Cookie
- T1087 Account Discovery
- T1526 Cloud Service Discovery
- T1069 Permission Groups Discovery
- T1114 Email Collection
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1102 Web Service
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1567 Exfiltration Over Web Service
- T1020 Automated Exfiltration
- T1657 Financial Theft

## Sources

- [EvilTokens device-code phishing kit totally more evil than we all thought](https://www.theregister.com/cyber-crime/2026/07/01/eviltokens-device-code-phishing-kit-totally-more-evil-than-we-all-thought/5265409)
- [ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365](https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/)
- [New widespread EvilTokens kit: device code phishing as-a-service](https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/)
- [Inside an AI-enabled device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2026/04/06/ai-enabled-device-code-phishing-campaign-april-2026/)
- [ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit](https://www.bleepingcomputer.com/news/security/artoken-phaas-exposes-eviltokens-microsoft-365-phishing-toolkit/)
- [The ARToken phishing panel targets Microsoft 365 accounts](https://www.helpnetsecurity.com/2026/07/01/artoken-phishing-panel-microsoft-365-accounts/)
- [EvilTokens ramps up device code phishing targeting Microsoft 365 users](https://www.helpnetsecurity.com/2026/03/31/eviltokens-phishing-microsoft-365/)
- [EvilTokens-Linked ARToken Panel Exposes 80+ APIs for Microsoft 365 Token Theft](https://gbhackers.com/eviltokens-linked-artoken-panel/)
- [This phishing kit looks more like BEC-as-a-service](https://cyberscoop.com/artoken-bec-platform-cisco-talos/)
- [Microsoft 365 Phishing Panel Uses OAuth Device Code Flow to Capture Tokens and Persist Access](https://cybersecuritynews.com/microsoft-365-phishing-panel-uses-oauth-device-code-flow/)
- [Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse](https://thehackernews.com/2026/03/device-code-phishing-hits-340-microsoft.html)
- [Kali365 Phishing-as-a-Service Kit Hijacks Microsoft 365 Access Tokens](https://www.ic3.gov/PSA/2026/PSA260521)
- [Storm-2372 conducts device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)
- [ARToken Phishing Kit Uses Cloudflare Workers and SharePoint Lures to Target Microsoft 365 Users](https://cyberpress.org/artoken-targets-microsoft-365/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1128