A phishing-as-a-service platform called “ARToken” is giving security researchers an inside look at how the EvilTokens ecosystem operates. Cisco Talos uncovered the platform during an incident response engagement and found a React-based management panel exposing more than 80 API endpoints.
This isn’t your average phishing kit. The platform can steal Microsoft 365 authentication tokens, establish persistent access using Primary Refresh Tokens (PRTs), and dig into Outlook mailboxes, SharePoint sites, and OneDrive files. Attackers can also deploy phishing infrastructure through Cloudflare Workers.
ARToken and EvilTokens share obvious DNA. Both use the same API calls for Microsoft’s device code authentication flow, including an identical endpoint that Sekoia first documented back in March. The platform also operates as a multi-tenant service where affiliates manage campaigns through dedicated workspaces.
EvilTokens exploits Microsoft’s OAuth 2.0 Device Authorization Grant workflow — better known as device code phishing. Victims enter a legitimate Microsoft-issued code on Microsoft’s own login page, but the tokens go straight to the attacker. It bypasses multi-factor authentication because the victim is authenticating through Microsoft’s own infrastructure.
The scale is getting absurd. Push Security reported device code phishing attacks surged 37-fold over the past year, with at least 11 kits now offering this technique.
