Cisco Talos uncovered ARToken, a phishing-as-a-service platform that appears to be affiliated with EvilTokens and is built to steal Microsoft 365 tokens and maintain persistent access. The kit supports device code phishing, Primary Refresh Token abuse, and full business email compromise operations against Outlook, SharePoint, and OneDrive accounts. #ARToken #EvilTokens #Microsoft365 #PrimaryRefreshToken #CloudflareWorkers

Cisco Talos uncovered ARToken, an affiliate platform tied to EvilTokens that appears to function as a “business email compromise-as-a-service” environment for phishing Microsoft 365 accounts and bypassing multi-factor authentication. The toolkit adds mature BEC features like inbox rule manipulation, shared access links, and a seven-layer anti-analysis system, with targeted lures abusing real vendor relationships and invoicing themes. #ARToken #EvilTokens #Microsoft365

Ce rapport technique est basé sur l'analyse du logiciel opérateur ARToken et la rétro-ingénierie de son API backend. Il documente une plateforme Phishing-as-a-Service (PhaaS) observée pour la première fois en juillet 2026, ciblant des utilisateurs Microsoft 365.

persistent access via Primary Refresh credentials (PRTs) read more about ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit