A highly sophisticated Phishing-as-a-Service (PhaaS) platform, ARToken, is actively targeting Microsoft 365 users by chaining together Cloudflare Workers and lookalike SharePoint tenants to bypass multi-factor authentication (MFA).
Emerging as an evolution of the notorious EvilTokens platform, this updated phishing kit abuses the Microsoft OAuth 2.0 Device Authorization Grant to capture victim tokens and establish persistent access.
Recent investigations by threat researchers highlight a shift from spray-and-pray tactics to highly targeted business email compromise (BEC) campaigns.
Earlier this year, security researchers documented the massive scale of EvilTokens, noting its AI-powered lures and automated device registration.
ARToken builds upon that foundation with an identical API contract and shared Primary Refresh Token (PRT) lifecycle.
However, ARToken introduces a more mature operational environment, running a single-page application dashboard that gives threat actors a complete suite of post-compromise BEC tools.
ARToken Targets Microsoft 365
The ARToken infection chain begins with highly targeted vendor impersonation. Attackers spoof accounts payable contacts at legitimate organizations to send outstanding invoice queries to their targets. T
o protect their spoofed identities, the attackers utilize a classic reply-pivot technique.
The email presents the vendor’s real domain in the ‘From’ header, but the ‘Reply-To’ field quietly redirects any victim response to an attacker-controlled domain.
Although these messages consistently fail SPF, DKIM, and DMARC checks, the familiar display identity often tricks users into taking action.
To deliver the malicious payload, the emails contain links that appear to point to a genuine SharePoint tenant. The destination is actually a look-alike workspace where the vendor’s domain name is folded directly into the tenant label.
Because this destination remains on a genuine Microsoft host, it inherently inherits SharePoint’s clean reputation and easily bypasses standard email security filters.
Once a victim clicks the link, ARToken deploys a heavily obfuscated JavaScript payload hosted on Cloudflare Workers.
Before the actual phishing page loads, the kit performs rigorous client-side behavioral verification to block automated security analysis. This human-verification logic includes several distinct checks.
Once the verification checks pass, the payload attempts to steal any existing JSON Web Tokens from the user’s local storage. The platform then directs the victim to Microsoft’s genuine device login page.
Because the kit specifically instructs the backend to use Microsoft’s Authentication Broker flow, it securely captures the victim’s authentication token.
It establishes a persistent session that survives even if the user resets their password, talosintelligence said.
ARToken Phishing Kit Analysis
| Layer | Mechanism | Purpose |
|---|---|---|
| 1 | User-Agent regex | Blocks headless browsers, Selenium, Puppeteer, Playwright, crawlers, wget, curl |
| 2 | navigator.webdriver check | Detects automation frameworks |
By combining infrastructure automation through the Cloudflare API with these advanced post-compromise tools, ARToken represents a significant escalation in the PhaaS landscape.
Its ability to import, refresh, and share PRTs transforms a simple phishing engagement into a resilient, long-term breach.
Security teams must prioritize monitoring for anomalous device code authentication flows and unauthorized inbox rule creations to detect this sophisticated threat.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 platform, ARToken, is actively targeting Microsoft 365 users by chaining){kind=link}