ARToken: The Microsoft 365 Phishing Kit That Beats MFA

Cisco Talos has pulled apart ARToken, a phishing-as-a-service platform that looks to be an affiliate of the already well-known EvilTokens operation. While tracing infrastructure during an incident response job, researchers found a React-based admin panel with more than 80 API endpoints, then reverse-engineered the JavaScript to see what paying affiliates actually get.

The answer, it turns out, is a fairly complete Microsoft 365 compromise kit.

What's in the box

Operators can steal authentication tokens, upgrade them to Primary Refresh Tokens for long-term access, rifle through Outlook, SharePoint and OneDrive, send mail as the victim, and set up quiet inbox rules to hide replies from the real user. Phishing pages are deployed on Cloudflare Workers and change their content based on where the victim is browsing from. Multiple affiliates run separate campaigns from their own workspaces. It behaves like a SaaS product, complete with a customer portal.

Why MFA doesn't help

The technique underneath is device code phishing, which abuses Microsoft's OAuth 2.0 device authorisation flow. The victim is tricked into typing a real Microsoft-issued code into Microsoft's real login page. Microsoft, doing exactly what it is designed to do, hands the resulting tokens back to whoever kicked off the flow. That happens to be the attacker.

Because the sign-in happens on legitimate infrastructure, multi-factor authentication is not the safety net people assume. There is no fake domain to spot, no dodgy certificate, no look-alike login screen. Push Security reckons these attacks have grown 37-fold in the past year, with at least 11 kits now selling the technique.

The EvilTokens family tree

EvilTokens itself was first documented by Sekoia in March, sold at a $1,500 setup fee and $500 a month. A follow-up found the operators had bolted on an AI pipeline that reads harvested mailboxes, scores the financial exposure of the victim, drafts business email compromise messages and translates stolen threads for operators working in other languages. It is a full workflow for turning a stolen inbox into wire fraud.

In the wild, Talos found ARToken affiliates impersonating vendors with invoice lures aimed at accounts payable staff, using look-alike SharePoint links hosted inside the attacker's own Microsoft 365 tenant. The tenant is real. The document is real. The problem is who owns them.

What actually works

The uncomfortable part of device code phishing is that most standard advice is useless here. Check the URL. Look for the padlock. Both are fine, and neither helps, because the URL is genuinely microsoft.com.

What gives the attack away is the request itself. Nobody in a normal working day is asked to type a short code into a Microsoft device login page on behalf of IT, a vendor, or a colleague. If that prompt arrives out of the blue, whether by email, Teams message or phone call, the correct response is to stop and check through a known channel rather than type. That instinct is not something a technical control can install for you. It is something people have to learn to recognise.