Executive Summary
ARToken is a sophisticated Phishing-as-a-Service (PhaaS) platform identified by Cisco Talos that shares infrastructure and operational patterns with the EvilTokens family. It targets Microsoft 365 environments by abusing the OAuth 2.0 Device Authorization Grant (RFC 8628). Unlike traditional phishing, ARToken bypasses MFA by inducing victims to enter a device code at the legitimate Microsoft login endpoint, allowing attackers to capture access tokens and Primary Refresh Tokens (PRTs) that persist even after password resets.
The platform provides affiliates with a comprehensive React-based dashboard for managing compromised accounts, including specialized tools for Business Email Compromise (BEC), SharePoint exfiltration, and evidence suppression through automated inbox rule manipulation. The phishing kit features a seven-layer anti-analysis system to evade detection by security crawlers and sandboxes, making it a significant threat to financial, HR, and accounts-payable departments globally.