**Resumo da Matéria:** Pesquisadores da Cisco Talos descobriram a ARToken, uma sofisticada plataforma de *Phishing-as-a-Service* (phishing por aluguel) especializada em invadir contas corporativas do Microsoft 365. O sistema se destaca por não focar em senhas tradicionais, mas sim no roubo de tokens de autenticação (chaves digitais), o que permite aos criminosos burlar a segurança de duplo fator (MFA) e espionar dados sigilosos sem acionar alertas de antivírus. O golpe utiliza a própria estrutura da Microsoft: a vítima, geralmente do setor financeiro, é induzida a digitar um código em uma página de login legítima após receber um e-mail falso sobre faturas. Com o acesso livre, o malware usa inteligência artificial para ler e-mails do usuário, mapear transações financeiras e até redigir novas mensagens fraudulentas. Como prevenção, especialistas recomendam o treinamento de equipes e a desativação do fluxo de autenticação por código de dispositivo no painel da Azure.

A new phishing-as-a-service (PhaaS) platform dubbed "ARToken" appears to operate as an affiliate of the EvilTokens phishing platform, giving researchers a glimpse into an extensive toolkit designed to compromise Microsoft 365. [...]

Sicherheitsforscher schlagen Alarm: Gleich mehrere ausgeklügelte Kampagnen zielen auf die Cloud-Dienste von Microsoft und Google ab. Die Angreifer nutzen Schwachstellen in OAuth-Authentifizierungsabläufen, um den als sicher geltenden Zwei-Faktor-Schutz zu umgehen und sich dauerhaften Zugriff auf Unternehmenskommunikation zu verschaffen.ARToken und Umbrij: Neue Plattformen im Visier von FirmenAnfang Juli 2026 machten Forscher von Cisco Talos eine beunruhigende […] The post OAuth-Lücke: ARToken und Umbrij umgehen Zwei-Faktor-Schutz appeared first on BornCity.

A new phishing-as-a-service (PhaaS) platform dubbed "ARToken" appears to operate as an affiliate of the EvilTokens phishing platform, giving researchers a glimpse into an extensive toolkit designed to...

Cisco Talos has uncovered ARToken, a full-fledged "BEC-as-a-service" platform linked to EvilTokens that uses sophisticated AI lures to hijack corporate accounts.

Pesquisadores da Cisco Talos descobriram uma **nova plataforma especializada em invadir contas corporativas do Microsoft 365**. Batizado de ARToken, o sistema atua como um serviço de phishing para cibercriminosos e chama a atenção pelo aparato técnico sofisticado, como o uso de inteligência artificial. O ARToken funciona sob o modelo de Phishing-as-a-Service (Phishing como um Serviço). Em outras palavras, é como se os desenvolvedores desse software malicioso tivessem criado essa plataforma e a alugassem para grupos hackers com menor experiência. Essa já é uma tática muito utilizada no submundo da internet. O grande perigo desse ARToken é que ele não vai atrás de meras senhas e credenciais das vítimas. **Esse malware busca os tokens de autenticação do usuário** , ou seja, as chaves digitais presentes naquela aplicação. Ao acessar essa chave, os cibercriminosos ficam com o caminho livre para espionar a máquina e roubar informações. Esse serviço de phishing consegue até mesmo burlar a autenticação de dois fatores (Imagem: Bleeping Computer/Reprodução). A parte interessante é que**esse vírus usa IA para ler os emails da vítima**. Ele consegue identificar quais mensagens são sobre transações financeiras e ainda pode redigir emails para enganar outras pessoas. Os invasores também conseguem apagar alertas de segurança e baixar dados do OneDrive e SharePoint. ## Golpe usa estrutura da Microsoft Por ser um golpe de phishing, a técnica do ARToken segue alguns padrões bem definidos e conhecidos. **As vítimas geralmente são funcionários do setor de finanças** , que recebem um e-mail falso se passando por um fornecedor legítimo com uma suposta fatura no SharePoint. Ao clicar no link, a vítima é induzida a entrar na página real de login da Microsoft e digitar um código gerado pelo criminoso. Como o login é feito no site oficial da Microsoft, a própria vítima aprova a entrada e passa pelo duplo fator de segurança (MFA). Contudo, devido à engenharia do golpe, a Microsoft emite o token de acesso diretamente para o servidor do hacker, dando a ele entrada livre à conta. Do lado mais técnico, **o ARToken possui um painel de controle avançado com mais de 80 portas de comunicação**. Isso permite que os criminosos gerenciem múltiplas campanhas de roubo de dados simultaneamente. Por meio dessa estratégia, é possível ter acesso a tudo relacionado com essas contas. A grande novidade desse tipo de golpe é que**ele se apoia justamente na estrutura oficial da Microsoft** , então as defesas de antivírus não são acionadas. Como forma de proteção, o ideal é sempre treinar as equipes ao informar que a Microsoft não exige códigos para liberar faturas ou ler documentos de trabalho. Para quem trabalha no setor de TI, uma das recomendações feitas pela Cisco é desabilitar o fluxo de autenticação por código de dispositivo no painel da Azure. Por falar de golpes envolvendo transações financeiras, um conhecido vírus bancário que atuava no Brasil agora faz vítimas na Espanha e Portugal. Siga o **TecMundo** no X, Instagram, Facebook e YouTube e assine a nossa newsletter para receber as principais notícias e análises diretamente no seu e-mail.

A Microsoft 365 device code phishing campaign observed in late June and early July 2026 used collaboration-themed lures and a compromised Croatian rental website to trick victims into authorizing attacker sessions through Microsoft’s legitimate device login flow. ZeroBEC and Cisco Talos linked the activity to reusable tooling and PhaaS ecosystems including...

Cisco Talos uncovered ARToken, a phishing-as-a-service platform that appears to be affiliated with EvilTokens and is built to steal Microsoft 365 tokens and maintain persistent access. The kit supports device code phishing, Primary Refresh Token abuse, and full business email compromise operations against Outlook, SharePoint, and OneDrive accounts. #ARToken #EvilTokens #Microsoft365 #PrimaryRefreshToken #CloudflareWorkers

Cisco Talos uncovered ARToken, an affiliate platform tied to EvilTokens that appears to function as a “business email compromise-as-a-service” environment for phishing Microsoft 365 accounts and bypassing multi-factor authentication. The toolkit adds mature BEC features like inbox rule manipulation, shared access links, and a seven-layer anti-analysis system, with targeted lures abusing real vendor relationships and invoicing themes. #ARToken #EvilTokens #Microsoft365

A new phishing-as-a-service (PhaaS) platform dubbed "ARToken" appears to operate as an affiliate of the EvilTokens phishing platform, giving researchers a glimpse into an extensive toolkit designed to compromise Microsoft 365. [...]

A newly uncovered phishing panel called ARToken is giving cybercriminals an easy way to steal Microsoft 365 login sessions without ever touching a password. The tool works by abusing a legitimate Microsoft sign in feature meant for devices without a keyboard or browser, tricking victims into approving a login on the attacker’s behalf. Once that approval happens, the attacker walks away with a working session token, no multi factor code required. What makes ARToken stand out is not just the theft itself but what happens afterward. The panel gives criminal operators a dashboard packed with more than eighty functions, covering everything from refreshing stolen tokens to reading a victim’s entire email inbox. It even offers tools to browse and download files from SharePoint and OneDrive, turning a single stolen login into a doorway for deeper compromise. Cisco Talos said in a report shared with Cyber Security News (CSN) that they identified the panel while investigating phishing infrastructure tied to an incident response case, and traced its code back to a live management dashboard exposing its entire toolkit publicly. The panel shares infrastructure, coding patterns, and identical backend commands with EvilTokens, a phishing as a service platform documented earlier this year by researchers at Sekoia and later confirmed by Microsoft as a large scale threat. By the time Microsoft acknowledged the scale of these device code attacks, researchers had already tracked roughly 500 Cloudflare Workers domains and more than 2,000 phishing pages tied to the broader EvilTokens operation. Affiliates targeted finance staff, human resources teams, and logistics personnel across multiple regions, often using AI generated messages tailored to each victim. ARToken appears to be a rebranded or closely related offshoot of that same criminal ecosystem, built for affiliates wanting a slicker interface and deeper post breach tools. Microsoft 365 Phishing Panel Uses OAuth Device Code Flow The attack usually begins with a convincing email impersonating a real vendor contact rather than inventing a fake company from scratch. In one case examined by researchers, the message spoofed an accounts payable contact at a legitimate contractor and directed the recipient toward what looked like a genuine SharePoint file link tied to an outstanding invoice. The visible link text pointed to the vendor’s real SharePoint tenant, but the actual destination quietly redirected to a nearly identical, attacker controlled workspace. Since the link still resolved to a real sharepoint.com address, it carried the trust normally associated with that platform, helping it slip past spam filters and cautious readers alike. Clicking through leads the victim to a fake Microsoft device login page , shown below in the panel’s own interface. ARToken login page (Source – Cisco Talos) The kit then displays a device code and asks the target to enter it at the real microsoft.com/devicelogin page, a step that feels routine to anyone who has set up a smart TV or streaming app before. Once entered, the backend silently captures a working access token without asking for a password. Built In Evasion and Persistence Tricks Before any of that happens, the phishing kit runs a seven layer screening process designed to filter out security scanners and automated bots. It checks browser fingerprints, watches for natural mouse movement, and waits nearly a full second before activating, an effort to convince the page it is dealing with a genuine human. The stolen token itself is only the beginning. ARToken can escalate that initial access into a longer lived credential known as a primary refresh token, which keeps working even after the victim changes their password. Human verification logic (Source – Cisco Talos) That design choice separates this attack from older phishing methods, since a normal password reset would otherwise shut an attacker out. From there, operators can read the victim’s full email inbox, send messages appearing to come from the compromised account, and quietly create inbox rules that hide or forward evidence of the intrusion. Security teams should treat unexpected device code prompts with suspicion and confirm unusual invoice or document requests through a separate, trusted channel before acting. Indicators of Compromise (IoCs):- Type Indicator Description Domain dashboard-bl.pamconj[.]com ARToken management panel hosting the React based operator dashboard  Domain spx.pamconj[.]com Command-and-control API endpoint for the ARToken phishing kit  Domain clear90489058903-document.workers[.]dev Cloudflare Workers account used to deploy phishing lures  URL https[:]//mononapfp.sharepoint[.]com/:f:/document/INV-IgCx1X50pgUjR7iAjZL2fuQaAW4GfKVs6wHT3BYv9sgwW7g Visible anchor link disguised as the vendor’s genuine SharePoint tenant  URL https[:]//mononapfpcom.sharepoint[.]com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEc Actual attacker-controlled SharePoint tenant used for redirection  File pumber.png Inline signature image included in phishing emails for content mutation  Identifier 84eb384d-cd3e-4c90-a283-c960ce557913 Hardcoded operator UUID used in device code API calls  Storage Key artoken_jwt LocalStorage key targeted to steal existing JWT tokens for session correlation  Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM .  Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. ->  Integrate ANY.RUN With Your SOC  Now . The post Microsoft 365 Phishing Panel Uses OAuth Device Code Flow to Capture Tokens and Persist Access appeared first on Cyber Security News .

Cisco Talos has uncovered ARToken, a full-fledged "BEC-as-a-service" platform linked to EvilTokens that uses sophisticated AI lures to hijack corporate accounts.