ARToken

The From line shows the vendor’s genuine domain, and Reply-To quietly points somewhere else, routing any response away from the impersonated company. SPF, DKIM, and DMARC all fail on the message.

The tool works by abusing a legitimate Microsoft sign in feature meant for devices without a keyboard or browser, tricking victims into approving a login on the attacker’s behalf. Once that approval happens, the attacker walks away with a working session token, no multi factor code required.

The attack usually begins with a convincing email impersonating a real vendor contact rather than inventing a fake company from scratch.

Phishing lures observed are targeted, mimicking legitimate vendor communications, such as an outstanding invoice inquiry, to trick accounts payable personnel.

The visible link text pointed to the vendor’s real SharePoint tenant, but the actual destination quietly redirected to a nearly identical, attacker controlled workspace.

The later checks wait for signs of a person, holding the payload until either a run of mouse movement or a screen touch registers and a short delay after load has passed.

The tool works by abusing a legitimate Microsoft sign in feature meant for devices without a keyboard or browser, tricking victims into approving a login on the attacker’s behalf. Once that approval happens, the attacker walks away with a working session token, no multi factor code required.

allowing operators to monitor inboxes, manipulate email rules to suppress evidence of the intrusion

The tool works by abusing a legitimate Microsoft sign in feature meant for devices without a keyboard or browser, tricking victims into approving a login on the attacker’s behalf. Once that approval happens, the attacker walks away with a working session token, no multi factor code required.

allowing operators to monitor inboxes, manipulate email rules to suppress evidence of the intrusion

It also employs advanced multi-layer anti-analysis techniques and encrypted payloads to evade detection and enhance phishing operations.

The message spoofed an accounts payable contact at a legitimate contractor and directed the recipient toward what looked like a genuine SharePoint file link tied to an outstanding invoice.

inbox rule creation for forwarding and deleting messages

The tool works by abusing a legitimate Microsoft sign in feature meant for devices without a keyboard or browser, tricking victims into approving a login on the attacker’s behalf. Once that approval happens, the attacker walks away with a working session token, no multi factor code required.

Before any of that happens, the phishing kit runs a seven layer screening process designed to filter out security scanners and automated bots. It checks browser fingerprints, watches for natural mouse movement, and waits nearly a full second before activating.

inbox rule creation for forwarding and deleting messages

ARToken operates as an affiliate of the EvilTokens phishing-as-a-service operation, which targets Microsoft 365 accounts and bypasses multi-factor authentication.

EvilTokens abuses Microsoft’s OAuth 2.0 Device Authorization Grant... The service captures a victim’s tokens during that exchange and bypasses multi-factor authentication.

Once entered, the backend silently captures a working access token without asking for a password.

The tool works by abusing a legitimate Microsoft sign in feature meant for devices without a keyboard or browser, tricking victims into approving a login on the attacker’s behalf.

The platform supports device code phishing, Primary Refresh Token (PRT) persistence, Business Email Compromise (BEC), SharePoint data exfiltration, and email access through a web-based dashboard.

Before any of that happens, the phishing kit runs a seven layer screening process designed to filter out security scanners and automated bots. It checks browser fingerprints, watches for natural mouse movement, and waits nearly a full second before activating.

The panel gives criminal operators a dashboard packed with more than eighty functions, covering everything from refreshing stolen tokens to reading a victim’s entire email inbox. It even offers tools to browse and download files from SharePoint and OneDrive.

ARToken can escalate that initial access into a longer lived credential known as a primary refresh token, which keeps working even after the victim changes their password.

From there, operators can read the victim’s full email inbox, send messages appearing to come from the compromised account, and quietly create inbox rules that hide or forward evidence of the intrusion.

From there, operators can read the victim’s full email inbox, send messages appearing to come from the compromised account, and quietly create inbox rules that hide or forward evidence of the intrusion.

The panel gives criminal operators a dashboard packed with more than eighty functions, covering everything from refreshing stolen tokens to reading a victim’s entire email inbox.

The platform supports device code phishing, Primary Refresh Token (PRT) persistence, Business Email Compromise (BEC), SharePoint data exfiltration, and email access through a web-based dashboard.

conduct full-scale exploration and data exfiltration from the victim’s SharePoint and OneDrive environments.

The tool works by abusing a legitimate Microsoft sign in feature meant for devices without a keyboard or browser, tricking victims into approving a login on the attacker’s behalf.

The platform also boasts a seven-layer anti-analysis system for evasion.

the email lure abused a real vendor relationship between a US life-sciences company and a legitimate plumbing and fire-protection contractor