Tool
ARToken
- First Reported
- Jul 1, 2026
- Latest Reported
- Aug 5, 2026
Reported Context (4)
- Criminal PhaaS kits like EvilTokens (340+ organizations in its first five weeks), Kali365 (which earned an FBI advisory), ARToken, DEBULL, Forg365, and many others all offer the capability. Push Security Argues AI-Powered Phishing Is Outpacing Blocklists
- ZeroBEC and Cisco Talos linked the activity to reusable tooling and PhaaS ecosystems including DEBULL, Storm-2372-style tradecraft, EvilTokens, ARToken, and Tycoon 2FA. DEBULL Tooling and Compromised Website Used in Microsoft 365 Device-Code Phishing Campaign
- Cisco Talos uncovered ARToken, a phishing-as-a-service platform that appears to be affiliated with EvilTokens and is built to steal Microsoft 365 tokens and maintain persistent access. Talos Finds Technical Ties Between ARToken and EvilTokens Phishing Services
- Cisco Talos uncovered ARToken, an affiliate platform tied to EvilTokens that appears to function as a “business email compromise-as-a-service” environment for phishing Microsoft 365 accounts and bypassing multi-factor Cisco Talos Identifies ARToken Phishing Platform With BEC Features
People (2)
Threat Actors (2)
MITRE ATT&CK (6)
Vendors (3)
Products (5)
Tools (10)
Industries (2)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.