ARToken & EvilTokens: The AI-Augmented Device Code Phishing PhaaS Hijacking Microsoft 365 and Automating BEC Fraud
Executive Summary
ARToken is a Phishing-as-a-Service (PhaaS) operator panel published by Cisco Talos on July 1, 2026, which Talos assesses to be an affiliate panel of the EvilTokens platform — the PhaaS that Sekoia identified in early March 2026 and that Microsoft confirmed operating at scale in April 2026. Both target Microsoft 365 using device code phishing — abusing the OAuth 2.0 Device Authorization Grant flow to bypass MFA entirely.
The core business risk comes from three reinforcing factors. First, device code phishing steals no password — it tricks the victim into authorizing the attacker's session, so traditional MFA (OTP, push, SMS) doesn't help. Second, after capturing tokens the attacker exchanges them for a Primary Refresh Token (PRT) to establish persistence that survives even a password reset. Third, EvilTokens integrates an AI pipeline that automates BEC fraud end-to-end — which Sekoia assesses as the first PhaaS to offer AI-augmented post-compromise tooling. Priority action: block or tightly restrict the device code flow via Conditional Access and accelerate phishing-resistant MFA (FIDO2 / passkeys) — two of the few defenses that still work against this specific technique.
What device code phishing is and why it bypasses MFA
Device code authentication is a legitimate OAuth 2.0 flow (RFC 8628) designed for input-constrained devices — like smart TVs or printers — where the user enters a short code on a separate device to complete sign-in. That very "complete authentication on a separate device" property creates a security tradeoff: the session initiating the request is not strongly bound to the user's original context.
Attackers abuse this by initiating the device code flow themselves, then pushing that code to the victim through a phishing lure. When the victim enters the code on the genuine microsoft.com/devicelogin page, they unwittingly authorize the attacker's session — no password is exposed, and MFA is still legitimately completed by the victim, but for the attacker's session.
The key upgrade in this campaign over earlier device code phishing is dynamic code generation. A device code lives only 15 minutes; older campaigns embedded the code in the email, so it often expired before the victim finished. EvilTokens/ARToken generate the code at the moment the victim clicks the link, ensuring it's always valid. Some variants even auto-copy the code to the victim's clipboard to shave seconds off the flow.
EvilTokens & ARToken — relationship and PhaaS ecosystem
EvilTokens runs through a structured Telegram workflow: a sales bot, a bot to deploy landing pages to Cloudflare Workers, and a separate bot selling anti-bot pages, plus a changelog channel. Pricing: $1,500 one-time for lifetime panel access, plus $500/month for the phishing-page code and an API key; a standalone "Portal Browser" sells for $500 lifetime to access multiple M365 accounts with stolen tokens. By the time of Microsoft's publication, Sekoia had documented roughly 500 Cloudflare Workers domains and over 1,000 phishing pages under the EvilTokens umbrella.
ARToken is the panel Talos discovered at dashboard-bl.pamconj[.]com — a React single-page application that exposes all client-side code (routes, API endpoints, UI logic) in its JavaScript bundle regardless of authentication state. Talos links ARToken to EvilTokens on several overlapping technical indicators:
Identical API contract: ARToken issues
POST /api/device/startwith a body containingclientMode: "broker",login_hint,redirect_url, and receivesdevice_code,user_code,verification_uri— exactly matching the EvilTokens API contract Sekoia documented.clientMode: "broker"semantics: this parameter instructs the backend to use the Microsoft Authentication Broker (WAM) flow for PRT acquisition — not a standard OAuth parameter, but specific to EvilTokens.Matching PRT lifecycle:
/prt/setup,/prt/refresh,/prt/renew,/prt/reacquire,/prt/cookie— the same PRT persistence chain Sekoia described as EvilTokens' core differentiator over traditional AitM.Matching deployment model: both deploy lures to Cloudflare Workers using UUID-prefixed subdomain patterns (
{uuid}-docviewer.workers.dev,{uuid}-onedrive.workers.dev,{uuid}-adobe2.workers.dev), with overlapping lure themes (Adobe, OneDrive, document viewers). In short, ARToken offers an "inside view" of the toolkit a real EvilTokens affiliate has at hand.
The AI-augmented BEC pipeline — the hottest part
This is what makes EvilTokens fundamentally different from a typical PhaaS. After capturing tokens, the backend runs parallel Microsoft Graph API queries for reconnaissance: reading messageRules (detecting existing rules), contacts (filtering finance/executive/HR/legal/procurement roles), events (picking the optimal BEC timing window), sentitems (extracting signatures + analyzing writing style), manager and directReports (for CEO fraud and internal directives), and organization (for domain spoofing). All of it is compiled into a reconnaissance report that provides context for the AI stage.
The LLM chain runs in two stages on the Groq API:
Stage 1 — using
llama-3.1-8b-instant, ingesting up to 5,000 emails (HTML bodies + attachment names) in batches of 250, plus the recon report, to summarize the financial exposure exploitable in the mailbox.Stage 2 — using
llama-3.3-70b-versatile, synthesizing the results and building a BEC attack scenario with three sample emails, scoring a BEC score from 1 to 100, with fields such as impersonation target, victim, amount, timing, and the inbox rules to create for interception/concealment. EvilTokens also usesgpt-4o-minivia the OpenAI API to translate stolen emails into English for attackers working non-English mailboxes.
Notably, these prompts open with an "AI jailbreak" — instructing the model to role-play an "authorized red team analyst" conducting a "sanctioned penetration test" to bypass the LLM's safety mechanisms, then forcing it to use real data instead of examples, rank findings by financial impact, and draft BEC emails "realistic enough to fool a trained employee." (This describes the prompt's structure and intent for defensive purposes only, without reproducing it verbatim.) Sekoia assesses that this full-chain automation — from token capture to BEC scenario drafting — drastically shrinks the defender's detection window, letting attackers weaponize tokens and perform post-compromise actions within minutes.
PRT persistence & the post-compromise toolkit
The ARToken panel exposes the full post-compromise workflow available to operators:
Token & persistence: refresh tokens to maintain access; escalate to PRT via
/prt/setup → /prt/refresh → /prt/cookie— the UI openly advertises "PRT-enabled — Persists across password changes"; export/backup/import tokens in bulk (enabling cross-platform token trading); share tokens with other operators via permissioned links. The kit setspersistAfterPassChange: false, signaling the operator understands refresh tokens are revoked on password reset and must exfiltrate or escalate to PRT before the victim reacts.Email/BEC (ARTSender): full inbox read access, sending email as the victim with BCC batching, creating forwarding/auto-delete inbox rules for evidence suppression, and cross-account keyword monitoring simultaneously.
SharePoint & OneDrive: browse/download/manage permissions on victim files — enabling document theft and malicious file placement for internal lateral phishing.
Infrastructure automation: integrates the Cloudflare API to deploy phishing templates directly to Workers from the panel.
Capabilities beyond prior reporting (per Talos): Box Monitor (keyword monitoring across many compromised mailboxes), programmatic inbox-rule manipulation, geo-dynamic templates (
{city}/{country_code}/{state}placeholders resolving by victim geolocation), and ARTBrowser — a Windows desktop app equivalent to EvilTokens' "Portal Browser." These features show this isn't a simple device code phishing kit but a complete BEC operations environment.
Anti-analysis
ARToken deploys a seven-layer client-side behavioral verification system — more sophisticated than the original EvilTokens server-side mechanism — per Talos:
| Layer | Mechanism | Purpose |
|---|---|---|
| 1 | User-Agent regex | Blocks headless browsers, Selenium, Puppeteer, Playwright, crawlers, wget, curl |
| 2 | navigator.webdriver check |
Detects automation frameworks |
| 3 | Browser feature fingerprinting | Flags environments missing window.chrome, navigator.vendor, touch/mouse APIs |
| 4 | Window dimension analysis | Catches headless reporting 0x0 outer dimensions |
| 5 | Interaction telemetry | Requires ≥3 mouse moves or ≥1 touch event before enabling the payload |
| 6 | Timing gate | Minimum 800ms since page load |
| 7 | Movement pattern analysis | Validates non-linear (organic) mouse trajectories |
The JavaScript payload is encrypted with a 16-byte XOR key decrypted at runtime (differing from the AES-GCM Sekoia observed in EvilTokens), to evade URL-scanner static analysis. The anti-bot page itself is sold separately as a product by EvilTokens through a dedicated Telegram bot, so affiliates can deploy upgraded anti-analysis modules independently of the core platform.
MITRE ATT&CK
Mapping per Cisco Talos:
| Tactic | Technique | ID |
|---|---|---|
| Initial Access | Phishing: Spearphishing Link | T1566.002 |
| Credential Access | Steal Application Access Token | T1528 |
| Persistence | Account Manipulation: Additional Cloud Credentials | T1098.001 |
| Collection | Email Collection: Remote Email Collection | T1114.002 |
| Lateral Movement | Use Alternate Authentication Material: Application Access Token | T1550.001 |
| Impact | Account Access Removal | T1531 |
| Resource Development | Acquire Infrastructure: Web Services | T1583.006 |
| Defense Evasion | Obfuscated Files or Information | T1027 |
| Defense Evasion | Virtualization/Sandbox Evasion: System Checks | T1497.001 |
Assessment
ARToken/EvilTokens illustrates two converging, mutually amplifying shifts. First, AI lowers the bar for BEC: BEC fraud used to require both technical and social-engineering skill to manually review mailboxes, find payment flows, and craft convincing scenarios — EvilTokens automates all of it and produces victim-tailored scenarios likely to achieve higher success rates and fraud value. Second, device code phishing neutralizes traditional MFA at the protocol-design level, not through a patchable vulnerability.
For enterprise environments in Vietnam on Microsoft 365, the direct consequence is that "MFA is enabled" is no longer sufficient. Accounting / accounts-payable / finance teams are priority targets — exactly matching the fake-vendor invoice lure Talos observed — so out-of-band verification of any payment-detail change should be tightened. One important operational note for incident response: per Microsoft, revoking refresh tokens often only invalidates the refresh token, while the access token stays valid for up to ~1 hour; against a fast-moving threat actor, consider temporarily disabling the account for immediate containment rather than only revoking sessions.
IOCs (Indicators of Compromise)
ARToken infrastructure — source: Cisco Talos (full IOCs in Talos' GitHub repo):
dashboard-bl.pamconj[.]com ARToken panel
spx.pamconj[.]com C2 API
clear90489058903-document.workers[.]dev Cloudflare Workers lure
Operator UUID: 84eb384d-cd3e-4c90-a283-c960ce557913
XOR key (16-byte): [233,69,224,219,53,48,213,165,119,243,77,151,101,148,15,227]
localStorage key: artoken_jwt
Lure pattern: {uuid}-docviewer.workers.dev / {uuid}-onedrive.workers.dev / {uuid}-adobe2.workers.dev
Campaign infrastructure (Microsoft) — source: Microsoft Defender Security Research:
162.220.232.0/24 (Railway.com) attacker infrastructure IP range
162.220.234.0/24 (Railway.com) attacker infrastructure IP range
89.150.45.0/24 (HZ Hosting) attacker infrastructure IP range
185.81.113.0/24 (HZ Hosting) attacker infrastructure IP range
graph-microsoft[.]com portal-azure[.]com office365-login[.]com (impersonation domains)
Example randomized subdomain: a7b2-c9d4.office-verify[.]net
Abused platforms: Vercel (*.vercel.app), Cloudflare Workers (*.workers.dev), AWS Lambda, Railway
Note: many indicators are legitimate serverless/PaaS platforms (Railway, Cloudflare, Vercel) being abused — hard-blocking by domain risks affecting legitimate services, so prioritize behavioral detection (anomalous device code auth) over blocklisting alone.
Recommendations
Block or restrict the device code flow via Conditional Access (allow only where truly needed); prioritize phishing-resistant MFA (FIDO2 / passkeys) and avoid phone/SMS-based MFA.
On suspected compromise: revoke refresh tokens and consider temporarily disabling the account (access tokens can survive ~1h after revocation); review forwarding/auto-delete inbox rules and anomalous new device registrations.
Deploy detection: ingest the KQL above into Sentinel/Defender XDR; enable Safe Links + Entra ID Protection for high-confidence device code phishing alerts.
Tighten financial processes: verify any payment-detail change out-of-band; specifically warn accounting/AP staff about fake-vendor invoice lures.
References
Cisco Talos — ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365
Sekoia TDR — EvilTokens: an AI-augmented Phishing-as-a-Service for automating BEC fraud – Part 2
Microsoft Defender Security Research — Inside an AI-enabled device code phishing campaign
BleepingComputer — ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit
BleepingComputer — New EvilTokens service fuels Microsoft device code phishing attacks
