ARToken

T1598 Phishing for Information Adversaries may send phishing messages to elicit sensitive information that can be used during targeting.

T1583.006 — Acquire Infrastructure: Web Services (Resource Development) ; Déploiement automatisé sur Cloudflare Workers depuis le panel

T1078 — Valid Accounts (Defense Evasion)

Researchers at Cisco Talos are tracking a sophisticated phishing-as-a-service operator panel called “ARToken” that’s built on the EvilTokens phishing platform.

ARToken focuses on targeted social engineering attacks, allowing operators to customize phishing attempts for each victim.

T1566.002 — Phishing: Spearphishing Link (Initial Access) ; Leurre : e-mail de relance de facture envoyé depuis une boîte Google Workspace ou Microsoft 365 compromise

T1204.001 User Execution: Malicious Link An adversary may rely upon a user clicking a malicious link in order to gain execution.

T1078 — Valid Accounts (Defense Evasion)

T1098 — Account Manipulation (Persistence) ; Escalade Entra : réinitialisation de mots de passe, création d’utilisateurs, modification des rôles (Global Administrator)

T1098.001 — Account Manipulation: Additional Cloud Credentials (Persistence)

T1136 — Create Account (Persistence) ; Escalade Entra : ... création d’utilisateurs

T1078 — Valid Accounts (Defense Evasion)

T1098 — Account Manipulation (Persistence) ; Escalade Entra : réinitialisation de mots de passe, création d’utilisateurs, modification des rôles (Global Administrator)

T1098.001 — Account Manipulation: Additional Cloud Credentials (Persistence)

The phishing kit also “deploys a seven-layer anti-analysis system combining client-side behavioral verification with XOR-encrypted payloads...

The phishing lures were tailored to the targeted organization, impersonating a legitimate vendor used by the company.

T1078 — Valid Accounts (Defense Evasion)

The phishing kit also “deploys a seven-layer anti-analysis system combining client-side behavioral verification with XOR-encrypted payloads, a more sophisticated evasion approach...

T1497.001 — Virtualization/Sandbox Evasion: System Checks (Defense Evasion)

T1564.008 — Hide Artifacts: Email Hiding Rules (Defense Evasion) ; Extraction de contacts et règles de boîte mail automatisées

T1110 — Brute Force (Credential Access)

Adversaries consistently defeated or bypassed MFA using AitM proxies and session-token theft... T1111 Multi-Factor Authentication Interception

T1528 — Steal Application Access Token (Credential Access) ; ARToken abuse du flux OAuth 2.0 device-authorization grant ... pour dérober des tokens d’accès et de rafraîchissement

The ARToken panel exposes 80+ API endpoints for device code phishing, Primary Refresh Token (PRT) persistence...

T1087.004 — Account Discovery: Cloud Account (Discovery)

The phishing kit also “deploys a seven-layer anti-analysis system combining client-side behavioral verification with XOR-encrypted payloads, a more sophisticated evasion approach...

T1497.001 — Virtualization/Sandbox Evasion: System Checks (Defense Evasion)

T1526 Cloud Service Discovery An adversary may attempt to enumerate the cloud services running on a system after gaining access.

T1534 — Internal Spearphishing (Lateral Movement) ; ARTSender : envoi de mails depuis le compte compromis via proxy

ARToken functions as a complete post-compromise toolkit that allows operators to leverage the captured access token recovered following successful device code authentication to maintain access.

T1550.001 — Use Alternate Authentication Material: Application Access Token (Lateral Movement)

The kit includes a full-fledged business email compromise tool with the following capabilities: “Full Outlook inbox read access per compromised account ... Keyword-based monitoring across all compromised accounts simultaneously Email attachment access and download”

T1114.002 — Email Collection: Remote Email Collection (Collection) ; Proxy Microsoft Graph : accès direct aux boîtes mail depuis le panel

Inbox rule creation for forwarding and auto-deletion (evidence suppression)

The incident resulted in the encryption of systems with the .SINOBI file extension, alongside observed data exfiltration staging activity conducted via rclone.exe... T1567 Exfiltration Over Web Service

The ARToken panel exposes 80+ API endpoints for device code phishing, Primary Refresh Token (PRT) persistence, email access, business email compromise (BEC) operations, and SharePoint exfiltration.

T1531 — Account Access Removal (Impact)

T1656 — Impersonation (Defense Evasion) ; La cible s’authentifie sur la vraie page Microsoft