ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365

A phishing-as-a-service platform known as ARToken has been identified, exhibiting significant overlap with the previously documented EvilTokens operation. This platform provides affiliates with a comprehensive toolkit for targeting Microsoft 365 accounts, including capabilities for device code phishing, Primary Refresh Token (PRT) persistence, email access, business email compromise (BEC) schemes, and data exfiltration from SharePoint.

The ARToken panel, accessible via a React-based dashboard, exposes over 80 API endpoints. Analysis of its publicly available JavaScript bundle reveals a post-compromise toolkit that includes functionalities not previously detailed in public reports on EvilTokens. The phishing kit employs a sophisticated seven-layer anti-analysis system, combining client-side behavioral verification with XOR-encrypted payloads, a more advanced evasion technique than the server-side mechanism observed in earlier EvilTokens research.

EvilTokens gained attention in early 2026 for its exploitation of Microsoft's OAuth 2.0 Device Authorization Grant to bypass multi-factor authentication and capture user tokens. Microsoft confirmed a rise in these attacks, noting increased success rates, the use of AI-powered lures, and automated device registration for persistent access. At the time of Microsoft's advisory, EvilTokens was associated with hundreds of domains and over a thousand phishing pages, targeting various professional roles globally. The platform's advanced capabilities included an AI-augmented BEC pipeline that generated tailored financial fraud scenarios.

The ARToken lure, as observed in recent campaigns, utilizes a targeted approach. Researchers recovered two nearly identical phishing emails sent on April 20, 2026, impersonating an accounts-payable contact of a legitimate Wisconsin contractor. These emails were sent to an accounts-payable recipient at a U.S. life-sciences company, leveraging a real vendor relationship. The emails inquired about outstanding invoices, a common tactic to prompt action from finance personnel.

Key features of the observed phishing emails include the use of the vendor's actual domain in the "From" header, while the "Reply-To" address redirected to an unrelated domain, a tactic to divert responses away from the impersonated organization. The emails failed SPF, DKIM, and DMARC authentication checks. Each message contained short random hexadecimal strings and an inline signature image, suggesting per-message mutations to evade content filters. The visible link text pointed to a legitimate SharePoint tenant, but the actual hyperlink directed to a look-alike tenant within an attacker-controlled Microsoft 365 workspace, exploiting SharePoint's trusted reputation.

The ARToken management panel was discovered during an investigation into phishing infrastructure. It operates as a single-page application, exposing its client-side code, including API endpoint paths, without requiring authentication. The associated command-and-control API and phishing lures deployed through Cloudflare Workers accounts were also identified.

The connection between ARToken and EvilTokens is established through several shared technical indicators. These include an identical API contract for initiating device code phishing, the use of a specific "broker" client mode for acquiring PRTs, and a matching deployment model utilizing Cloudflare Workers with similar subdomain naming conventions and lure themes. Furthermore, ARToken's API surface includes endpoints for managing the Primary Refresh Token lifecycle, mirroring EvilTokens' core functionality for persistent access. Both platforms also share an operational model as multi-tenant phishing-as-a-service offerings with isolated operator workspaces, Telegram notifications, subscription-based access, and lure customization tools.

The ARToken phishing kit's anti-analysis system is notably more advanced than previously documented EvilTokens mechanisms. It employs a seven-layer client-side verification process that checks User-Agent strings, detects automation frameworks, fingerprints browser features, analyzes window dimensions, requires user interaction, enforces a timing gate, and validates mouse movement patterns. This client-side approach is more sophisticated than the server-side "X-Antibot-Token" mechanism described in earlier EvilTokens research.

The phishing payload itself, once decrypted, attempts to steal existing JWTs from local storage, extracts the victim's email from URL parameters, and initiates the device code phishing process by calling the ARToken C2 API. The kit includes a setting that indicates the operator understands that refresh tokens are revoked upon password reset, signaling an intent to exfiltrate data or escalate to PRT before the victim can respond. The JavaScript payload is delivered encrypted using a 16-byte XOR key, which is decrypted at runtime.