Back Feeds.4Sysops

ARToken phishing panel automates Microsoft 365 compromise and BEC operations

Feeds.4Sysops •IT News • July 2, 2026

The ARToken phishing-as-a-service platform has emerged as a sophisticated evolution of the EvilTokens ecosystem, specifically targeting Microsoft 365 environments. It abuses the OAuth 2.0 Device Authorization Grant, a protocol intended for keyboardless devices, to trick users into authenticating attacker sessions. This method effectively bypasses multi-factor authentication by leveraging legitimate Microsoft sign-in endpoints to capture session tokens. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

EvilTokens Phishing Kit Exploits Microsoft 365 with AI-Driven BEC Tactics In March 2026, the EvilTokens phishing kit emerged as a significant threat, allowing cybercriminals to bypass multi-factor authentication (MFA) and compromise Microsoft 365 accounts. This Phishing-as-a-Service (PhaaS) platform utilizes Microsoft's OAuth 2.0 Device Authorization Grant to capture victim tokens, enabling Business Email Compromise (BEC) attacks. The platform has rapidly gained traction, with Microsoft reporting hundreds of organizations compromised daily. Cisco Talos identified an affiliate panel named ARToken, which enhances EvilTokens' capabilities by incorporating AI for personalized lures and automated post-compromise actions. The phishing campaigns have increased by 1,380% compared to the previous year, with targeted emails leveraging real vendor relationships to deceive victims. The attack method involves sending emails that appear legitimate but redirect to attacker-controlled Microsoft 365 workspaces. Current assessments indicate that EvilTokens and its affiliates are continuously evolving their tactics, posing a serious threat to organizations using Microsoft 365. 24 sources 71

Extracted Entities

ARToken phishing panel automates Microsoft 365 compromise and BEC operations

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (2)

Tools (1)