ARToken PhaaS Exposes EvilTokens Microsoft 365 Phishing Toolkit

Cisco Talos researchers have uncovered a phishing-as-a-service (PhaaS) platform named “ARToken” that operates as an affiliate of the EvilTokens ecosystem, exposing a sophisticated toolkit built to compromise Microsoft 365 environments at scale. The discovery began during an incident response engagement, where researchers identified a React-based management dashboard called the “ARToken Panel” that exposed more than 80 API endpoints, with reverse engineering of its client-side JavaScript revealing capabilities far beyond typical phishing kits. Stolen Microsoft 365 authentication tokens can be used to establish persistent access via Primary Refresh Tokens (PRTs) and to reach Outlook mailboxes, SharePoint sites, and OneDrive files, and organizations can verify exposure of corporate credentials through an email breach checker.

Multiple technical overlaps strongly link ARToken to EvilTokens, the platform first documented by Sekoia in March 2025. Both use the same Microsoft device code authentication flow, sharing an identical “POST /api/device/start” request, and rely on the same Primary Refresh Token API endpoints for setup, refresh, renewal, and reacquisition—even after expiry. The platform also mirrors EvilTokens’ Cloudflare Workers deployment model and operates as a multi-tenant service in which affiliates run campaigns from dedicated workspaces. Defenders investigating suspicious Microsoft 365 login activity can validate session and connection details with a DNS leak test to spot traffic being routed through attacker-controlled infrastructure.

The toolkit’s core technique is device code phishing, which exploits Microsoft’s legitimate OAuth 2.0 Device Authorization Grant flow. Victims are lured into entering a Microsoft-issued device code on the official login page, which causes Microsoft to issue authentication tokens directly to the attacker—allowing MFA protections to be bypassed because the authentication occurs through trusted Microsoft infrastructure. ARToken further automates business email compromise (BEC) operations, and a follow-up Sekoia report revealed an AI-driven workflow that ingests harvested mailboxes, scores financial exposure, and uses LLMs to draft and translate BEC lures. With a reported $1,500 setup fee and $500 monthly subscription, and Microsoft warning that device code phishing attacks are surging, security teams should harden password and token policies and monitor PRT activity closely.