A new phishing-as-a-service (PhaaS) platform dubbed 'ARToken' has been discovered, giving researchers a glimpse into an extensive toolkit designed to compromise Microsoft 365. The platform, which appears to operate as an affiliate of the EvilTokens phishing platform, was discovered by Cisco Talos researchers while investigating phishing infrastructure used in an incident response engagement.
ARToken PhaaS Platform
The ARToken platform allows attackers to steal Microsoft 365 authentication tokens, establish persistent access using Primary Refresh Tokens (PRTs), and access Outlook mailboxes, SharePoint sites, and OneDrive files. It also includes tools to deploy phishing infrastructure through Cloudflare Workers and automate many aspects of business email compromise (BEC) operations.
Technical Similarities with EvilTokens
According to Talos' report, multiple technical similarities strongly suggest ARToken is tied to the EvilTokens phishing platform discovered earlier this year. The researchers found the ARToken phishing kit uses the same API calls for Microsoft's device code authentication flow, including an identical 'POST /api/device/start' request previously associated with EvilTokens attacks.
Talos also identified the same primary refresh token API endpoints documented in Sekoia's EvilTokens research, including the endpoints for setting up, refreshing, renewing, and reacquiring Primary Refresh Tokens, even after they expire. The platform also uses a similar Cloudflare Workers deployment model and operates as a multi-tenant phishing service, in which affiliates manage their own campaigns through dedicated workspaces.
EvilTokens Phishing Platform
EvilTokens focuses heavily on exploiting Microsoft's OAuth 2.0 Device Authorization Grant authentication workflow to breach accounts, a technique known as device code phishing. Victims are tricked into entering a legitimate Microsoft-issued device code on Microsoft's official device login page, causing Microsoft to issue authentication tokens directly to the attacker instead of the victim.
Because the victim authenticates through Microsoft's legitimate infrastructure, the attacks can successfully bypass multi-factor authentication protections. Microsoft's device code authentication login form is used to trick victims into entering their device code, which is then used to obtain authentication tokens.
AI-Driven Workflow
Sekoia first documented the EvilTokens platform in March, describing it as a commercial phishing service sold to cybercriminals for a $1,500 setup fee and a $500 monthly subscription. In a follow-up report, Sekoia found an AI-driven workflow that ingests harvested mailboxes to score financial exposure, then uses AI and LLMs to draft BEC campaigns and translate stolen emails for operators working in other languages.
Microsoft later warned about the platform as device code phishing attacks surged dramatically, and numerous threat actors adopted the technique due to its high success rate against Microsoft 365 users. What sets EvilTokens apart from other device code phishing kits is its use of AI to automate fraud.
ARToken Functionality
Talos' report provides a detailed overview of the functionality available to EvilTokens affiliates following a successful account compromise. Once a victim completes the device code authentication process, ARToken allows operators to refresh stolen tokens and elevate access to persistent primary refresh tokens (PRT).
The researchers also found tools for conducting business email compromise attacks, including full Outlook mailbox access, the ability to send emails as compromised users, the ability to create inbox rules that automatically forward or hide messages, the ability to monitor multiple mailboxes for keywords simultaneously, and the ability to download email attachments.
Attackers can also browse, upload, download, and manage files stored in victims' SharePoint sites and OneDrive accounts, enabling data theft and the delivery of malware for additional attacks. ARToken also revealed several features not identified in previous EvilTokens research.
Phishing Emails
Talos analyzed phishing emails associated with the platform, finding that attackers impersonated legitimate vendors in invoice-themed lures targeting accounts payable employees. Rather than linking to an obviously attacker-controlled site, the emails display what appears to be a legitimate SharePoint address while actually directing victims to a look-alike tenant hosted within the attacker's Microsoft 365 workspace.
In April, Push Security reported that device code phishing attacks had surged 37-fold over the past year, with at least 11 phishing kits now offering this technique to cybercriminals. For organizations looking to defend against modern Microsoft 365 phishing attacks, business email compromise (BEC), and account takeovers, it is essential to implement robust security measures and stay informed about the latest threats and techniques used by attackers.
Test every layer before attackers do. Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper to learn more about how to protect your organization from phishing and other cyber threats.
Source: BleepingComputer