INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

EvilTokens Affiliate Panel Targets Microsoft 365 with Phishing Toolkit

| 2026-07-01 10:00 CRITICAL HIGH PHISHING & SOCIAL ENGINEERING
JSON
Executive Summary
AI-generated
A new phishing-as-a-service (PhaaS) platform dubbed "ARToken" appears to operate as an affiliate of the EvilTokens phishing platform, exposing over 80 API endpoints and revealing extensive capabilities designed to compromise Microsoft 365. The attack works by using a React-based management panel called "ARToken Panel", allowing attackers to steal authentication tokens, establish persistent access using Primary Refresh Tokens (PRTs), and access various Microsoft services such as Outlook mailboxes and OneDrive files. As of the latest report from Cisco Talos researchers on July 3rd, 2026, multiple technical similarities suggest ARToken is tied to EvilTokens, with identical API calls for device code authentication flow and primary refresh token endpoints previously documented in Sekoia's research. The current status indicates that this phishing toolkit has been exposed, providing a glimpse into the extensive capabilities of the EvilTokens platform, which was first documented by Sekoia in March 2026.
Technical Mitigations AI-generated
• Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • Restrict Web-Based Content (ATT&CK mitigation for Phishing): Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl, etc.) that can be used for phishing are necessary for business operations and consider bloc
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 5 IoCs Create Free Account
hxxp://••••••••••••••••••••
cl•••••.dev
sp•••••.com
da•••••.com
pu•••••.png
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
‎March 2026
Threat actors using EvilTokens' phishing-as-a-service exploited Microsoft's OAuth 2.0 Device Authorization Grant to bypass multi-factor authentication and capture victim tokens.
tactic Phishing
Background: EvilTokens and device code phishing-as-a-service In March 2026, Sekoia published a two-part analysis of EvilTokens, a PhaaS platform that abuses Microsoft's OAuth 2.0 Device Authorization Grant (RFC 8628) to capture victim tokens while bypassing multi-factor authentication (MFA) entirely.
organisation MFA
Background: EvilTokens and device code phishing-as-a-service In March 2026, Sekoia published a two-part analysis of EvilTokens, a PhaaS platform that abuses Microsoft's OAuth 2.0 Device Authorization Grant (RFC 8628) to capture victim tokens while bypassing multi-factor authentication (MFA) entirely.
general_metric 2.0 OAuth
Background: EvilTokens and device code phishing-as-a-service In March 2026, Sekoia published a two-part analysis of EvilTokens, a PhaaS platform that abuses Microsoft's OAuth 2.0 Device Authorization Grant (RFC 8628) to capture victim tokens while bypassing multi-factor authentication (MFA) entirely.
‎April 2026
EvilTokens' affiliate panel targeted Microsoft 365 using vendor-impersonation invoice fraud, with the campaign's scale confirmed by Microsoft in April 2026.
organisation Cloudflare Workers
By the time of Microsoft's publication, Sekoia had documented approximately 500 Cloudflare Workers domains and over 1,000 total phishing pages operating under the EvilTokens umbrella, with affiliates targeting finance professionals, HR staff, and logistics personnel across global regions.
infrastructure 500 Workers domains
By the time of Microsoft's publication, Sekoia had documented approximately 500 Cloudflare Workers domains and over 1,000 total phishing pages operating under the EvilTokens umbrella, with affiliates targeting finance professionals, HR staff, and logistics personnel across global regions.
organisation Groq
EvilTokens' second-stage capabilities, revealed in Sekoia's Part 2 research , include an AI-augmented BEC pipeline chaining Groq-hosted Llama models for financial exposure scoring and GPT-4o-mini for email translation, producing three tailored BEC scenarios per compromised mailbox.
financial $500 $ lifetime
The platform sells access at $1,500 one-time plus $500/month, with a standalone "Portal Browser" for $500 lifetime.
‎April 20, 2026
Threat actors used ARToken's API surface to target Microsoft 365, utilizing a phishing kit with identical lifecycle and deployment model as EvilTokens.
organisation SPA
During investigation of phishing infrastructure targeting a Talos IR engagement, we identified a management panel at “dashboard-bl.pamconj[.]com” serving a React single-page application (SPA) with a 1.7MB compiled JavaScript bundle.
organisation MB
During investigation of phishing infrastructure targeting a Talos IR engagement, we identified a management panel at “dashboard-bl.pamconj[.]com” serving a React single-page application (SPA) with a 1.7MB compiled JavaScript bundle.
infrastructure 1.7 compiled JavaScript bundle
During investigation of phishing infrastructure targeting a Talos IR engagement, we identified a management panel at “dashboard-bl.pamconj[.]com” serving a React single-page application (SPA) with a 1.7MB compiled JavaScript bundle.
organisation POST
Linking ARToken to EvilTokens The connection between ARToken and EvilTokens rests on multiple overlapping technical indicators: Identical API contract: ARToken's phishing kit issues POST /api/device/start with a JSON body containing userId, clientMode: "broker", login_hint, and redirect_url.
organisation UUID
Matching deployment model: Both platforms deploy phishing lures to Cloudflare Workers using UUID-prefixed subdomain patterns.
organisation Cloudflare
Infrastructure automation The panel integrates directly with Cloudflare's API for: Authenticating via API token or Global API key Listing deployed Workers Deploying phishing templates directly to Workers from the panel Managing allowed origins and worker name prefixes Configuring device code proxy servers Desktop session browser (ARTBrowser)
organisation Listing deployed Workers Deploying
Infrastructure automation The panel integrates directly with Cloudflare's API for: Authenticating via API token or Global API key Listing deployed Workers Deploying phishing templates directly to Workers from the panel Managing allowed origins and worker name prefixes Configuring device code proxy servers Desktop session browser (ARTBrowser)
organisation Workers
Infrastructure automation The panel integrates directly with Cloudflare's API for: Authenticating via API token or Global API key Listing deployed Workers Deploying phishing templates directly to Workers from the panel Managing allowed origins and worker name prefixes Configuring device code proxy servers Desktop session browser (ARTBrowser)
organisation UI
SPA architecture exposes all client-side code including routes, UI labels, component logic, and API endpoint paths in the JavaScript bundle regardless of authentication state.
data_breach 16 byte
XOR payload encryption The JavaScript payload is delivered encrypted with a 16-byte XOR key ([233,69,224,219,53,48,213,165,119,243,77,151,101,148,15,227]), decrypted at runtime.
infrastructure Microsoft 365
The visible anchor text reads as the vendor's genuine SharePoint tenant: “https[:]//mononapfp.sharepoint[.]com/:f:/document/INV-IgCx1X50pgUjR7iAjZL2fuQaAW4GfKVs6wHT3BYv9sgwW7g” However, the actual href points to a near-identical look-alike tenant — the vendor's name with the .com folded directly into the tenant label — under a different, attacker-controlled Microsoft 365 workspace.
A standalone Windows application, functionally equivalent to EvilTokens' "Portal Browser," enables operators to browse victim Microsoft 365 sessions using captured tokens outside the web panel.
infrastructure Windows
A standalone Windows application, functionally equivalent to EvilTokens' "Portal Browser," enables operators to browse victim Microsoft 365 sessions using captured tokens outside the web panel.
victims 365 victim sessions
A standalone Windows application, functionally equivalent to EvilTokens' "Portal Browser," enables operators to browse victim Microsoft 365 sessions using captured tokens outside the web panel.
organisation ARToken Panel
The page title reads "ARToken Panel."
organisation Authentication Broker
Shared clientMode: "broker" semantics: This parameter instructs the backend to use Microsoft's Authentication Broker (WAM) flow for PRT acquisition.
organisation PRT
Shared clientMode: "broker" semantics: This parameter instructs the backend to use Microsoft's Authentication Broker (WAM) flow for PRT acquisition.
organisation Adobe
The naming convention and lure themes (Adobe, OneDrive, document viewers) overlap directly.
organisation OneDrive
The naming convention and lure themes (Adobe, OneDrive, document viewers) overlap directly.
organisation Affiliates
Affiliates may deploy upgraded or custom anti-analysis modules independently of the core platform.
organisation AES
This differs from EvilTokens' documented AES-GCM Web Crypto API encryption.
organisation Token
The ARToken panel's API surface reveals the complete post-compromise workflow available to operators: Token management and persistence Once a victim completes device code authentication, their captured token appears in the ARToken dashboard.
‎2026/07/01
Threat actors using the EvilTokens affiliate panel exploited Microsoft 365's OAuth 2.0 Device Authorization Grant authentication workflow to breach accounts via device code phishing attacks.
organisation BEC
The ARToken panel exposes 80+ API endpoints for device code phishing, Primary Refresh Token (PRT) persistence, email access, business email compromise (BEC) operations, and SharePoint exfiltration — all accessible to operators through a React-based dashboard.
organisation SharePoint
The ARToken panel exposes 80+ API endpoints for device code phishing, Primary Refresh Token (PRT) persistence, email access, business email compromise (BEC) operations, and SharePoint exfiltration — all accessible to operators through a React-based dashboard.
organisation XOR
The phishing kit deploys a seven-layer anti-analysis system combining client-side behavioral verification with XOR-encrypted payloads, a more sophisticated evasion approach than the server-side X-Antibot-Token mechanism documented in prior EvilTokens research.
victims 1 User Agent
Technical analysis: The phishing kit  Layer Mechanism Purpose 1 User-Agent regex Blocks headless browsers, Selenium, Puppeteer, Playwright, crawlers, wget, curl 2 navigator.webdriver check Detects automation frameworks 3 Browser feature fingerprinting Identifies environments missing window.chrome, navigator.vendor, or touch/mouse APIs 4 Window dime…
organisation JWT
The phishing payload itself fires on DOMContentLoaded and: Attempts to steal any existing JWT from localStorage (key: artoken_jwt) for victim session correlation Extracts the victim's email from the URL ?hint= parameter Calls the C2 at /device/start with the hardcoded operator UUID 84eb384d-cd3e-4c90-a283-c960ce557913 Displays the returned device code with a countdown timer (default:…
organisation BCC
…creation for forwarding and auto-deletion (evidence suppression) Keyword-based monitoring across all compromised accounts simultaneously Email attachment access and download SharePoint and OneDrive access Operators can browse, upload, download, and manage permissions on victim SharePoint sites and OneDrive files, enabling document theft and malicious file placement for lateral phishing.
organisation Inbox
…creation for forwarding and auto-deletion (evidence suppression) Keyword-based monitoring across all compromised accounts simultaneously Email attachment access and download SharePoint and OneDrive access Operators can browse, upload, download, and manage permissions on victim SharePoint sites and OneDrive files, enabling document theft and malicious file placement for lateral phishing.
organisation Keyword
…creation for forwarding and auto-deletion (evidence suppression) Keyword-based monitoring across all compromised accounts simultaneously Email attachment access and download SharePoint and OneDrive access Operators can browse, upload, download, and manage permissions on victim SharePoint sites and OneDrive files, enabling document theft and malicious file placement for lateral phishing.
organisation Operators
…creation for forwarding and auto-deletion (evidence suppression) Keyword-based monitoring across all compromised accounts simultaneously Email attachment access and download SharePoint and OneDrive access Operators can browse, upload, download, and manage permissions on victim SharePoint sites and OneDrive files, enabling document theft and malicious file placement for lateral phishing.
organisation Shared
…erators with role-based permissions Geo-dynamic templates Lure placeholders ({city}, {country_code}, {state}) that resolve based on victim geolocation Full SharePoint operations Site resolution, file upload/download, permission management These features indicate the platform is more mature than a simple device code phishing kit — it is a complete BEC operations environment.
organisation Initial Access
MITRE ATT&CK techniques  Tactic Technique ID Initial Access Phishing: Spearphishing Link T1566.002 Credential Access Steal Application Access Token T1528 Persistence Account Manipulation: Additional Cloud Credentials T1098.001 Collection Email Collection: Remote Email Collection T1114.002 Lateral Movement Use Alternate Authentication Mate…
organisation Credential Access
MITRE ATT&CK techniques  Tactic Technique ID Initial Access Phishing: Spearphishing Link T1566.002 Credential Access Steal Application Access Token T1528 Persistence Account Manipulation: Additional Cloud Credentials T1098.001 Collection Email Collection: Remote Email Collection T1114.002 Lateral Movement Use Alternate Authentication Mate…
organisation Collection
MITRE ATT&CK techniques  Tactic Technique ID Initial Access Phishing: Spearphishing Link T1566.002 Credential Access Steal Application Access Token T1528 Persistence Account Manipulation: Additional Cloud Credentials T1098.001 Collection Email Collection: Remote Email Collection T1114.002 Lateral Movement Use Alternate Authentication Mate…
organisation Resource Development
MITRE ATT&CK techniques  Tactic Technique ID Initial Access Phishing: Spearphishing Link T1566.002 Credential Access Steal Application Access Token T1528 Persistence Account Manipulation: Additional Cloud Credentials T1098.001 Collection Email Collection: Remote Email Collection T1114.002 Lateral Movement Use Alternate Authentication Mate…
organisation T1583.006 Stealth
MITRE ATT&CK techniques  Tactic Technique ID Initial Access Phishing: Spearphishing Link T1566.002 Credential Access Steal Application Access Token T1528 Persistence Account Manipulation: Additional Cloud Credentials T1098.001 Collection Email Collection: Remote Email Collection T1114.002 Lateral Movement Use Alternate Authentication Mate…
organisation Stealth
MITRE ATT&CK techniques  Tactic Technique ID Initial Access Phishing: Spearphishing Link T1566.002 Credential Access Steal Application Access Token T1528 Persistence Account Manipulation: Additional Cloud Credentials T1098.001 Collection Email Collection: Remote Email Collection T1114.002 Lateral Movement Use Alternate Authentication Mate…
infrastructure Microsoft 365
ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit.
A new phishing-as-a-service (PhaaS) platform dubbed "ARToken" appears to operate as an affiliate of the EvilTokens phishing platform, giving researchers a glimpse into an extensive toolkit designed to compromise Microsoft 365.
Microsoft later warned about the platform as device code phishing attacks surged dramatically, and numerous threat actors adopted the technique due to its high success rate against Microsoft 365 users.
For organizations looking to defend against modern Microsoft 365 phishing attacks, business email compromise (BEC), and account takeovers, BleepingComputer is hosting a webinar with Abnormal titled " Stop chasing alerts:
ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365.
The platform allows attackers to steal Microsoft 365 authentication tokens, establish persistent access using Primary Refresh Tokens (PRTs), and access Outlook mailboxes, SharePoint sites, and OneDrive files.
Rather than linking to an obviously attacker-controlled site, the emails display what appears to be a legitimate SharePoint address while actually directing victims to a look-alike tenant hosted within the attacker's Microsoft 365 workspace.
infrastructure 80 API endpoints
Cisco Talos researchers discovered the platform while investigating phishing infrastructure used in an incident response engagement and identified a React-based management panel called "ARToken Panel" that exposed more than 80 API endpoints.
financial $500 $ lifetime
Microsoft's device code authentication login form Sekoia first documented the EvilTokens platform in March, describing it as a commercial phishing service sold to cybercriminals for a $1,500 setup fee and a $500 monthly subscription.
financial $1,500 $ setup fee
Microsoft's device code authentication login form Sekoia first documented the EvilTokens platform in March, describing it as a commercial phishing service sold to cybercriminals for a $1,500 setup fee and a $500 monthly subscription.
victims 365 victim sessions
Microsoft later warned about the platform as device code phishing attacks surged dramatically, and numerous threat actors adopted the technique due to its high success rate against Microsoft 365 users.
organisation EvilTokens
ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365.
‎early 2026
Threat actors using the ARToken affiliate panel exploited phishing-as-a-service capabilities to target Microsoft 365.
tactic Phishing
Cisco Talos identified a fully-featured phishing-as-a-service (PhaaS) operator panel, branded "ARToken," that shares infrastructure, API contracts, and operational patterns with the EvilTokens platform documented by Sekoia and Microsoft in early 2026.
organisation ARToken
Cisco Talos identified a fully-featured phishing-as-a-service (PhaaS) operator panel, branded "ARToken," that shares infrastructure, API contracts, and operational patterns with the EvilTokens platform documented by Sekoia and Microsoft in early 2026.
organisation API
Cisco Talos identified a fully-featured phishing-as-a-service (PhaaS) operator panel, branded "ARToken," that shares infrastructure, API contracts, and operational patterns with the EvilTokens platform documented by Sekoia and Microsoft in early 2026.
organisation Sekoia
Cisco Talos identified a fully-featured phishing-as-a-service (PhaaS) operator panel, branded "ARToken," that shares infrastructure, API contracts, and operational patterns with the EvilTokens platform documented by Sekoia and Microsoft in early 2026.
organisation Microsoft
Cisco Talos identified a fully-featured phishing-as-a-service (PhaaS) operator panel, branded "ARToken," that shares infrastructure, API contracts, and operational patterns with the EvilTokens platform documented by Sekoia and Microsoft in early 2026.
Tactical Metrics
Metrics
infrastructure
500
Workers Domains
By the time of Microsoft's publication, Sekoia had documented approximately 500 Cloudflare Workers domains and over 1,000 total phishing pages operating under the EvilTokens umbrella, with affiliates targeting finance professionals, HR staff, and logistics personnel across global regions.
Metrics
infrastructure
2
Compiled Javascript Bundle
During investigation of phishing infrastructure targeting a Talos IR engagement, we identified a management panel at “dashboard-bl.pamconj[.]com” serving a React single-page application (SPA) with a 1.7MB compiled JavaScript bundle.
Metrics
victims
1
User Agent
Technical analysis: The phishing kit  Layer Mechanism Purpose 1 User-Agent regex Blocks headless browsers, Selenium, Puppeteer, Playwright, crawlers, wget, curl 2 navigator.webdriver check Detects automation frameworks 3 Browser feature fingerprinting Identifies environments missing window.chrome, navigator.vendor, or touch/mouse APIs 4 Window dime…
Metrics
infrastructure
‎Microsoft 365
Affected Product
ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365.
The visible anchor text reads as the vendor's genuine SharePoint tenant: “https[:]//mononapfp.sharepoint[.]com/:f:/document/INV-IgCx1X50pgUjR7iAjZL2fuQaAW4GfKVs6wHT3BYv9sgwW7g” However, the actual href points to a near-identical look-alike tenant — the vendor's name with the .com folded directly into the tenant label — under a different, attacker-controlled Microsoft 365 workspace.
A standalone Windows application, functionally equivalent to EvilTokens' "Portal Browser," enables operators to browse victim Microsoft 365 sessions using captured tokens outside the web panel.
ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit.
A new phishing-as-a-service (PhaaS) platform dubbed "ARToken" appears to operate as an affiliate of the EvilTokens phishing platform, giving researchers a glimpse into an extensive toolkit designed to compromise Microsoft 365.
Microsoft later warned about the platform as device code phishing attacks surged dramatically, and numerous threat actors adopted the technique due to its high success rate against Microsoft 365 users.
For organizations looking to defend against modern Microsoft 365 phishing attacks, business email compromise (BEC), and account takeovers, BleepingComputer is hosting a webinar with Abnormal titled " Stop chasing alerts:
The platform allows attackers to steal Microsoft 365 authentication tokens, establish persistent access using Primary Refresh Tokens (PRTs), and access Outlook mailboxes, SharePoint sites, and OneDrive files.
Rather than linking to an obviously attacker-controlled site, the emails display what appears to be a legitimate SharePoint address while actually directing victims to a look-alike tenant hosted within the attacker's Microsoft 365 workspace.
Metrics
infrastructure
‎Windows
Affected Product
A standalone Windows application, functionally equivalent to EvilTokens' "Portal Browser," enables operators to browse victim Microsoft 365 sessions using captured tokens outside the web panel.
Metrics
victims
365
Victim Sessions
A standalone Windows application, functionally equivalent to EvilTokens' "Portal Browser," enables operators to browse victim Microsoft 365 sessions using captured tokens outside the web panel.
Microsoft later warned about the platform as device code phishing attacks surged dramatically, and numerous threat actors adopted the technique due to its high success rate against Microsoft 365 users.
Metrics
data_breach
16
Byte
XOR payload encryption The JavaScript payload is delivered encrypted with a 16-byte XOR key ([233,69,224,219,53,48,213,165,119,243,77,151,101,148,15,227]), decrypted at runtime.
Metrics
financial
500
$ Lifetime
The platform sells access at $1,500 one-time plus $500/month, with a standalone "Portal Browser" for $500 lifetime.
Microsoft's device code authentication login form Sekoia first documented the EvilTokens platform in March, describing it as a commercial phishing service sold to cybercriminals for a $1,500 setup fee and a $500 monthly subscription.
Metrics
infrastructure
80
Api Endpoints
Cisco Talos researchers discovered the platform while investigating phishing infrastructure used in an incident response engagement and identified a React-based management panel called "ARToken Panel" that exposed more than 80 API endpoints.
Metrics
financial
1,500
$ Setup Fee
Microsoft's device code authentication login form Sekoia first documented the EvilTokens platform in March, describing it as a commercial phishing service sold to cybercriminals for a $1,500 setup fee and a $500 monthly subscription.
Intelligence Sources
BleepingComputer 2026-07-03
Talos Intelligence 2026-07-01