Loading threat actor…
ARToken is a phishing-as-a-service platform and operator environment focused on compromising Microsoft 365 accounts. It is closely linked to the EvilTokens ecosystem through shared infrastructure patterns, matching API contracts, and similar operational workflows. The platform is designed for affiliate use and supports multi-tenant operations with isolated operator workspaces, subscription-style access, lure template management, and notification features. ARToken specializes in device code phishing by abusing Microsoft's OAuth 2.0 Device Authorization Grant to obtain access tokens while bypassing multifactor authentication workflows. It supports post-compromise token operations including refresh, export, import, backup, sharing between operators, and escalation to Primary Refresh Token persistence. The platform also provides a broader business email compromise toolkit, including web-based access to victim mailboxes, inbox rule manipulation, keyword monitoring, attachment access, and delayed or batched outbound email operations. A built-in capability known as ARTSender is used to facilitate these email-centric fraud workflows. Beyond email compromise, ARToken enables operators to access and manage victim SharePoint and OneDrive content, including browsing, uploading, downloading, and permission management, making it suitable for both data theft and operational follow-on abuse. It also integrates with Cloudflare Workers deployment workflows to automate phishing lure hosting and infrastructure management. A separate Windows application, ARTBrowser, has been used to browse victim Microsoft 365 sessions using captured tokens outside the main web panel. ARToken employs comparatively mature evasion and anti-analysis measures for a phishing kit. Documented protections include a seven-layer client-side anti-analysis system using user-agent filtering, browser automation checks, browser feature fingerprinting, window-dimension analysis, interaction telemetry, timing gates, and mouse-movement analysis. Its payload delivery also uses runtime decryption with encrypted client-side code. Overall, ARToken is best characterized as a mature phishing-as-a-service and business email compromise operations environment rather than a simple credential-harvesting kit. Known aliases and closely associated naming include ARToken and its linkage to the EvilTokens ecosystem.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
12 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Operates as a phishing-as-a-service platform used for Microsoft 365 account compromise, supporting device code phishing, Primary Refresh Token persistence, business email compromise, SharePoint data exfiltration, and web-based email access, while using anti-analysis and encrypted payload techniques.
Operates a phishing-as-a-service platform centered on Microsoft device code phishing, token theft, PRT-based persistence, BEC enablement, and SharePoint/OneDrive access through a multi-tenant operator panel.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.