Loading story…
Researchers detailed ARToken, a phishing-as-a-service platform that abuses Microsoft 365's OAuth 2.0 device authorization flow to steal access and refresh tokens after victims enter a device code on Microsoft's legitimate sign-in page. The operation uses invoice-themed phishing emails, compromised SharePoint links, and Cloudflare Workers redirectors with anti-bot features, avoiding fake login pages and effectively bypassing MFA while reducing the visibility of traditional phishing detections. Reported infrastructure tied to the activity includes pamconj.com, corabuild.eu, multiple workers.dev domains, and several DigitalOcean IP addresses.
The reporting reflects a broader surge in device-code phishing, with CrowdStrike observing a 1,500% increase in the first half of 2026 as both criminal and state-linked actors adopt the technique. Analysts say the tradecraft has evolved from a niche method into a productized ecosystem, with services such as ARToken and Kali365 offering lure generation, dashboards, token capture, and multi-affiliate support, while post-compromise activity includes Microsoft Graph mailbox access, inbox-rule abuse, password resets, user creation, role changes, fraudulent MFA enrollment, and business email compromise. Defenders are being urged to restrict device-code sign-ins, tightly govern exceptions, and correlate device authorization events with downstream Microsoft 365 activity and new device registrations.
Get the infrastructure and lures behind it.
6 events from the most recent confirmed update back to the earliest known activity.
ARToken, a phishing-as-a-service platform targeting Microsoft 365 users through OAuth 2.0 device authorization abuse, was first observed in July 2026. The platform uses legitimate Microsoft device login flows to steal access and refresh tokens and supports multi-affiliate operations.
Device code phishing spread from Russian state use to cybercriminal groups during 2025. Actors associated with Tycoon 2FA were identified as notable adopters.
CrowdStrike measured a 134% increase in vishing between 2024 and 2025. The reporting frames this as part of a broader shift toward social engineering methods that bypass traditional email defenses.
A Russian threat actor tracked by Microsoft as Storm-2372 began using device code phishing in an operational campaign. The activity targeted organizations across government, defense, energy, and other sectors in North America, Europe, Africa, and the Middle East.
Microsoft researcher Nestori Syynimaa published a blog post describing the technique now known as device code phishing. The article anchors this publication to October 13, 2020.
Abnormal AI published a technical report detailing ARToken's infrastructure, attack chain, token capture workflow, persistence options, and post-compromise capabilities. The report also listed domains, Cloudflare Workers hosts, and IP addresses as indicators of compromise.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
blog.alphahunt.io
Open sourcedarkreading.com
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified **EvilTokens** as a new phishing-as-a-service platform built to hijack **Microsoft 365** accounts by abusing Microsoft’s legitimate OAuth 2.0 **device code** authentication flow. Sold and operated through Telegram bots, the service gives affiliates phishing templates, email harvesting and reconnaissance features, automated Microsoft API interactions, webmail access, and mailbox triage capabilities. Victims are lured into entering attacker-supplied device codes on Microsoft’s real login page, allowing attackers to capture access and refresh tokens—and in some cases a **Primary Refresh Token**—without stealing passwords or directly defeating MFA. Security teams linked a sharp rise in device code phishing to EvilTokens, describing it as the first known turnkey PhaaS offering dedicated Microsoft device code phishing pages and warning that it lowers the barrier for low-skill operators. More than **1,000 phishing domains** were observed by late March, with campaigns affecting organizations worldwide and notable activity in the United States, Australia, Canada, France, India, Switzerland, and the United Arab Emirates; finance, HR, and transportation/logistics staff were highlighted as frequent targets. Researchers from Sekoia and Mnemonic urged defenders to disable or restrict unnecessary device code flows in **Microsoft Entra ID**, monitor device code grant sign-ins for anomalies, train users on device authentication abuse, and revoke refresh tokens when compromise is suspected.
Jul 22, 2026
Attackers are abusing the OAuth 2.0 Device Authorization Grant to obtain Microsoft 365 account tokens without stealing passwords. They initiate a legitimate device-code sign-in on an attacker-controlled application or device, then persuade targets through meeting, document-sharing, chat, or security-themed lures to enter the supplied temporary code on a genuine Microsoft sign-in page. Because victims complete the authentication and consent themselves, URL checks and MFA may not stop the attack; the resulting tokens can expose email, files, contacts, and other authorized services. Post-authentication activity can include device registration or Primary Refresh Token issuance, Microsoft Graph queries, mailbox access, and Exchange inbox rules that hide alerts or forward data externally. Defenders should correlate phishing delivery and click telemetry with device-code sign-ins, new-device events, Graph activity, and mailbox-rule changes; contain confirmed incidents by revoking sessions and refresh tokens, disabling unrecognized devices, removing malicious rules, and assessing accessed data. Microsoft recommends blocking device-code flow by default with Entra Conditional Access, first in report-only mode, while maintaining tightly scoped persistent exceptions for legitimate Teams resource accounts and excluding the Device Registration Service where required for enrollment.
Sep 23, 2026
The phishing-as-a-service platform **EvilTokens** sharply expanded attacks against Microsoft 365 accounts by abusing Microsoft’s legitimate **device code OAuth flow** to steal access tokens after victims completed real Microsoft logins and multi-factor authentication. Huntress reported a **1,380% increase** in device code phishing activity between late 2025 and early 2026, with campaigns affecting hundreds of organizations. The operation used **AI-generated personalized phishing lures** and automated post-compromise analysis to support follow-on business email compromise, while relying on legitimate cloud services including **Railway**, **BL Networks/BitLaunch**, and **Cloudflare Workers** to blend in with normal traffic. EvilTokens was marketed openly on **Telegram** as a subscription service priced from **$600 to $1,500**, lowering the barrier for less sophisticated criminals to launch token-theft campaigns that can bypass MFA protections. Huntress said **57.5%** of observed attacks were tied to Railway or BL Networks infrastructure, and that blocking Railway IP addresses through Conditional Access prevented more than **600 incidents** before attackers shifted hosting. Defenders were urged to restrict or block device code authentication where possible, review sign-in logs for suspicious Railway-originated authentications, revoke stolen tokens, audit Microsoft Graph API activity, and update user awareness training because genuine Microsoft login pages can still be part of a phishing attack.
Jun 29, 2026