cyber.hendryadrian.com
Security News · cyberscoop.com

Cisco Talos Identifies ARToken Phishing Platform With BEC Features

· Original article ↗

Summary

Cisco Talos identified ARToken, an affiliate platform linked to EvilTokens that targets Microsoft 365 accounts and can bypass MFA. Its BEC features include inbox rule manipulation, shared access links and a seven-layer anti-analysis system.

Key points

  • Cisco Talos identified ARToken as an operator panel and affiliate platform linked to EvilTokens; the linkage is reported, not independently established in the article.
  • The platform is described as enabling phishing against Microsoft 365 accounts and bypassing multi-factor authentication.
  • Its reported BEC capabilities include inbox rule manipulation and shared access links.
  • ARToken reportedly uses a seven-layer anti-analysis system.
  • A Cisco Talos example used an outstanding-invoice lure that spoofed a real vendor relationship to target accounts-payable staff.
  • Talos said it does not yet know the full scope of the activity or who is using ARToken.

Article Details

Event Type
Cisco Talos reported discovering ARToken, a phishing affiliate platform linked to the EvilTokens phishing-as-a-service operation and designed to support business email compromise.
Impact
ARToken reportedly supports phishing targeting Microsoft 365 accounts and bypassing multi-factor authentication, with inbox-rule manipulation and shared access links that could facilitate business email compromise and fraudulent payment requests. Cisco Talos said it does not yet know the full scope of the activity or who is using the platform.

MITRE ATT&CK

T1114.003 · Email Forwarding RuleARToken reportedly includes inbox rule manipulation, consistent with email forwarding rule abuse.

People

Michael KelleyCisco Talos security research engineer who discussed ARToken’s capabilities and analyzed the phishing lure described in the report.

Threat Actors

EvilTokensDescribed as a phishing-as-a-service operation linked to ARToken and built to bypass multi-factor authentication and compromise Microsoft 365 accounts. The article reports an increase in its phishing attacks but does not identify who is using ARToken.

Products

Microsoft 365 Apps for Enterprisethat appears to function as a “business email compromise-as-a-service” environment for phishing Microsoft 365 accounts and bypassing multi-factor authentication.

Tools

ARTokenCisco Talos uncovered ARToken, an affiliate platform tied to EvilTokens that appears to function as a “business email compromise-as-a-service” environment for phishing Microsoft 365 accounts and bypassing multi-factor

Countries

United States“The messages spoof an accounts-payable contact at a legitimate Wisconsin contractor, addressed to an accounts-payable recipient at a U.S.

Industries

Life Scienceslife sciences company — abusing a real vendor relationship rather than inventing a sender,” Kelley wrote.Public Sector“We’ve seen the public sector targeted but it’s unlikely to be the only one,” he said.

Related Articles