PhishingPublished 1 Jul 2026

ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365

Source Cisco Talos

Description

Talos has identified "ARToken," a phishing-as-a-service platform that targets Microsoft 365. The ARToken panel exposes 80+ API endpoints for device code phishing, Primary Refresh Token persistence, email access, BEC operations, and SharePoint exfiltration.

Impact

The ARToken platform enables attackers to bypass multi-factor authentication by abusing OAuth 2.0 device code flows, capturing and persisting access tokens for Microsoft 365 accounts. This allows unauthorized access to victim email inboxes, the ability to send emails as the victim, create inbox rules to hide malicious activity, and access SharePoint and OneDrive files. The platform supports business email compromise operations and lateral phishing, increasing the risk of financial fraud and data exfiltration. Persistent token access survives password resets, complicating remediation. The service's automation and multi-tenant model facilitate scalable, targeted phishing campaigns against organizations using Microsoft 365.

Defensive guidance

Organizations should rely on Microsoft’s security controls and guidance for detecting and mitigating OAuth abuse and device code phishing. Users should be trained to recognize sophisticated phishing lures, especially those abusing vendor relationships and legitimate SharePoint URLs. Monitoring for suspicious token activity and enforcing conditional access policies that limit OAuth token scopes and lifetimes can help reduce risk. Since this is an external threat platform, remediation focuses on detection and response rather than patching. Check vendor advisories from Microsoft for updated mitigation recommendations regarding OAuth device code phishing attacks.

References

blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 1 Jul 2026, 10:14 UTC

References

Community reviews