Threat
ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365
Publication date not yet evaluated · Added · 3 reports talosintelligence.com
Page published · Page updated
Coverage timeline
Why it matters
EvilTokens shows criminals operationalizing LLMs (Llama and GPT-4o-mini) to mass-produce personalized BEC lures and automate post-compromise fraud at scale, making AI-weaponized phishing a live enterprise threat that defeats MFA via device-code abuse.
Microsoft, with Cisco Talos, Cloudflare and others, disrupted EvilTokens, an AI-augmented phishing-as-a-service platform (with an affiliate panel branded ARToken) that abused Microsoft's OAuth 2.0 Device Authorization Grant to bypass MFA and silently capture Microsoft 365 tokens, tied to roughly 12,000 inbox compromises. The platform chained Groq-hosted Llama models for financial-exposure scoring and GPT-4o-mini for email translation to auto-generate tailored BEC lures, and exposed 80+ API endpoints for token persistence, email access, and SharePoint exfiltration.
Summary
Cisco Talos identified 'ARToken,' a fully-featured phishing-as-a-service operator panel that shares infrastructure, API contracts, and operational patterns with the EvilTokens device-code phishing platform documented by Sekoia and Microsoft in early 2026, marking it as an EvilTokens affiliate targeting Microsoft 365.[0][2]
EvilTokens abuses Microsoft's OAuth 2.0 Device Authorization Grant to capture victim tokens while bypassing multi-factor authentication entirely, and Microsoft reported the campaign was compromising hundreds of organizations daily with 10 to 15 distinct campaigns launching every 24 hours since March 15, 2026.[0][2]
Talos documented how an ARToken lure reaches an inbox: two near-identical outstanding-invoice messages sent about four minutes apart on April 20, 2026 abused a genuine vendor relationship, spoofing a legitimate Wisconsin contractor to target an accounts-payable recipient at a U.S. life-sciences company, using a reply-pivot and a copycat SharePoint tenant on a legitimate sharepoint.com host to evade detection.[0][2]
Beyond phishing, the ARToken panel exposes 80+ API endpoints and a complete BEC operations environment — token/PRT persistence, full Outlook inbox access, sending as the victim, inbox rule creation, keyword monitoring, and SharePoint exfiltration — protected by a seven-layer anti-analysis system, indicating a platform more mature than a simple device-code phishing kit.[0][2]
Attack chain
- Initial access — targeted lure: Attackers send an outstanding-invoice email abusing a real vendor relationship, spoofing a legitimate Wisconsin contractor's accounts-payable contact and targeting an accounts-payable recipient at a U.S. life-sciences company. The From header shows the vendor's real domain while Reply-To redirects to an unrelated attacker domain.[0][2]
- Delivery — copycat SharePoint link: The email's visible anchor text reads as the vendor's genuine SharePoint tenant, but the actual href points to a near-identical copycat tenant on an attacker-controlled Microsoft 365 workspace hosted on a legitimate sharepoint.com host, reducing the chance of the message being flagged as phishing.[0]
- Credential/token capture — device code phishing: The kit abuses Microsoft's OAuth 2.0 Device Authorization Grant to capture victim tokens and silently authenticate as the victim to Microsoft 365 applications while bypassing MFA, protected by a seven-layer anti-analysis system with client-side behavioral verification and XOR-encrypted payloads.[0][2]
- Persistence: The panel provides token management and Primary Refresh Token persistence mechanisms for durable access to compromised accounts.[0][2]
- Post-compromise — BEC operations: Operators use a built-in BEC toolkit offering full Outlook inbox read access, email sending as the victim, inbox rule creation for forwarding and deleting messages, keyword-based monitoring across all compromised accounts, and SharePoint exfiltration.[0][2]
Disclosure timeline
| Date | Event |
|---|---|
| March 2026 | Sekoia published a two-part analysis first documenting the EvilTokens device-code phishing-as-a-service platform.[0][2] |
| March 15, 2026 | Microsoft began observing 10 to 15 distinct device-code phishing campaigns launching every 24 hours.[0] |
| April 2026 | Microsoft confirmed the campaign's scale, reporting hundreds of organizations compromised daily and noting AI-powered personalized lures and automated device registration for persistence.[0][2] |
| April 20, 2026 | Talos recovered two near-identical ARToken lure messages sent roughly four minutes apart, initiating the vendor-impersonation invoice-fraud chain.[0][2] |
| July 1, 2026 | Cisco Talos published its ARToken research detailing the affiliate panel, its 80+ API endpoints, the seven-layer anti-analysis system, and the BEC toolkit.[0][2] |
Actor profile
EvilTokens / ARToken
EvilTokens is a phishing-as-a-service platform abusing Microsoft's OAuth 2.0 Device Authorization Grant to bypass MFA, sold at $1,500 one-time plus $500/month with a $500 lifetime 'Portal Browser.' ARToken is an affiliate operator panel that shares EvilTokens' infrastructure, identical API contracts, and deployment/operational models, exposing 80+ endpoints and a full BEC operations environment. Affiliates use targeted, vendor-impersonation tradecraft rather than spray-and-pray, and the platform incorporates an AI-augmented BEC pipeline using Groq-hosted Llama and GPT-4o-mini models.[0][2]
How it works
The kit abuses Microsoft's OAuth 2.0 Device Authorization Grant (RFC 8628) — a legitimate authentication flow — to trick victims into completing device-code authentication, capturing valid tokens and silently authenticating as the victim to Microsoft 365 while bypassing MFA entirely.[0][2]
Evasion relies on a seven-layer anti-analysis system combining client-side behavioral verification with XOR-encrypted payloads, an approach Talos assesses as more sophisticated than the server-side X-Antibot-Token mechanism seen in prior EvilTokens research. Delivery abuses legitimate sharepoint.com hosts via copycat tenants so links appear trustworthy.[0][2]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Microsoft 365 (OAuth 2.0 Device Authorization Grant / device code authentication) | Organizations using Microsoft 365 whose users can complete device-code authentication flows; observed targeting of finance, HR, and logistics personnel and accounts-payable staff. | Not a software patch issue — the technique abuses a legitimate authentication flow; mitigation is via configuration and monitoring rather than a vendor fix cited in the evidence.[0][2] |
Key takeaways
- ARToken shows EvilTokens has matured from a device-code phishing kit into a complete BEC operations environment, with an affiliate model, 80+ API endpoints, token persistence, and full mailbox control.[0][2]
- Device-code phishing bypasses MFA and leverages legitimate Microsoft infrastructure (sharepoint.com, OAuth device flow), so defenders must rely on behavioral and identity monitoring rather than link-reputation or MFA alone.[0][2]
- The tradecraft is targeted rather than spray-and-pray, abusing genuine vendor relationships and accounts-payable workflows, which raises the bar for user-awareness and email-authentication controls.[0][2]
Defensive actions
- Scrutinize links even when they resolve to legitimate sharepoint.com hosts, and inspect the actual href versus displayed anchor text for copycat tenants under attacker-controlled Microsoft 365 workspaces.: ARToken lures point to near-identical copycat SharePoint tenants on legitimate sharepoint.com hosts specifically so messages are less likely to be flagged as phishing.[0]
- Flag messages where the Reply-To domain differs from the From domain, especially outstanding-invoice and accounts-payable themed emails from known vendors.: The lures spoof a real vendor's domain in the From header while quietly redirecting replies to an unrelated attacker domain to keep victim responses away from the spoofed organization.[0][2]
- Monitor Microsoft 365 for anomalous device-code authentication and new device registrations, and hunt for unauthorized inbox forwarding/deletion rules and mass keyword monitoring.: The platform bypasses MFA via device code flow, uses token/PRT persistence and automated device registration, and its BEC toolkit creates inbox rules for forwarding/deleting and keyword monitoring across compromised accounts.[0][2]