Talos Finds Technical Ties Between ARToken and EvilTokens Phishing Services
Summary
Cisco Talos reverse-engineered ARToken, a Microsoft 365 phishing platform that appears linked to EvilTokens. The toolkit steals authentication tokens, supports persistent access, and enables mailbox and cloud-file access.
Key points
- Talos discovered ARToken while investigating phishing infrastructure and identified a React-based panel exposing more than 80 API endpoints.
- Reverse engineering revealed Microsoft device-code authentication and Primary Refresh Token functions similar to those documented for EvilTokens.
- ARToken can steal Microsoft 365 tokens and use Primary Refresh Tokens to maintain access.
- The toolkit supports Outlook mailbox access, email sending and forwarding rules, and monitoring or downloading mailbox content.
- Operators can browse, upload, and download files from victims’ SharePoint and OneDrive accounts.
- Talos found invoice-themed phishing emails impersonating vendors and directing victims to look-alike SharePoint pages hosted in an attacker-controlled Microsoft 365 workspace.
Article Details
- Attack Vectors
- Device-code phishing tricks victims into entering a legitimate Microsoft-issued code on Microsoft’s device login page, allowing attackers to obtain authentication tokens and bypass MFA.
- ARToken steals Microsoft 365 authentication tokens and uses Primary Refresh Tokens to maintain persistent access.
- The platform supports BEC operations, including accessing Outlook mailboxes, sending email as compromised users, creating rules to forward or hide messages, and monitoring mailboxes for keywords.
- Operators can browse, upload, download, and manage files in victims’ SharePoint and OneDrive accounts.
- Invoice-themed phishing emails impersonate legitimate vendors and target accounts payable employees, directing victims to a look-alike tenant hosted in the attacker’s Microsoft 365 workspace.
- ARToken supports deploying phishing infrastructure through Cloudflare Workers.
- Defensive Notes
- Account for device-code phishing in defenses: victims may authenticate through Microsoft’s legitimate device login page while attackers obtain the resulting tokens, bypassing MFA.
MITRE ATT&CK
T1114.002 · Remote Email CollectionARToken enables access to compromised Outlook mailboxes and downloading email attachments.T1114.003 · Email Forwarding RuleOperators can create inbox rules to forward or hide messages in compromised mailboxes.T1213.002 · SharepointOperators can browse and download files from victims’ SharePoint sites.T1528 · Steal Application Access TokenARToken obtains Microsoft 365 authentication tokens through device-code phishing.T1550.001 · Application Access TokenOperators use stolen Microsoft 365 authentication tokens and Primary Refresh Tokens to access accounts and maintain access.T1566.002 · Spearphishing LinkInvoice-themed phishing emails impersonate vendors and direct accounts payable employees to a look-alike tenant.
Vendors
CloudflareIt also includes tools to deploy phishing infrastructure through Cloudflare Workers and automate many aspects of business email compromise (BEC) operations.MicrosoftCisco Talos uncovered ARToken, a phishing-as-a-service platform that appears to be affiliated with EvilTokens and is built to steal Microsoft 365 tokens and maintain persistent access.
Products
Cloudflare WorkersIt also includes tools to deploy phishing infrastructure through Cloudflare Workers and automate many aspects of business email compromise (BEC) operations.Microsoft 365 Apps for EnterpriseCisco Talos uncovered ARToken, a phishing-as-a-service platform that appears to be affiliated with EvilTokens and is built to steal Microsoft 365 tokens and maintain persistent access.Microsoft OneDriveThe kit supports device code phishing, Primary Refresh Token abuse, and full business email compromise operations against Outlook, SharePoint, and OneDrive accounts.Microsoft SharePointThe kit supports device code phishing, Primary Refresh Token abuse, and full business email compromise operations against Outlook, SharePoint, and OneDrive accounts.OutlookThe kit supports device code phishing, Primary Refresh Token abuse, and full business email compromise operations against Outlook, SharePoint, and OneDrive accounts.
Tools
ARTokenCisco Talos uncovered ARToken, a phishing-as-a-service platform that appears to be affiliated with EvilTokens and is built to steal Microsoft 365 tokens and maintain persistent access.EvilTokensCisco Talos uncovered ARToken, a phishing-as-a-service platform that appears to be affiliated with EvilTokens and is built to steal Microsoft 365 tokens and maintain persistent access.