ARToken is an EvilTokens affiliate panel that sends vendor invoice emails, captures Microsoft 365 tokens through device code phishing and gives operators built-in tools for business email compromise. Researchers found it during an incident response engagement.

The sign-in is genuine, so the password and the MFA prompt both pass on Microsoft's side. What the operator receives is a token, and the panel can turn it into longer-lived access. The reporting does not say how many organizations were reached.

How do attackers carry out vendor email compromise with a lookalike SharePoint tenant?

Vendor email compromise is usually described as a hijacked or impersonated supplier account sending a fraudulent invoice or a bank change. ARToken adds a second step. The invoice email is the delivery vehicle for a sign-in, not only for a payment request.

The Register reports that researchers recovered two near-identical emails on 20 April 2026. They used an outstanding-invoice lure ("the following invoices appear to still be outstanding") and exploited a real relationship between a US life-sciences company and a plumbing and fire-protection contractor. Help Net Security adds that the sender spoofed an accounts-payable contact at a Wisconsin contractor and the recipient was a payments contact at the life-sciences company.

What the email gives away, and what it hides

Help Net Security reports that SPF, DKIM and DMARC all failed on the message, and that each copy carried short random text and an inline signature image. In AegisAI's assessment, the random text is consistent with light per-message variation meant to defeat exact-match filters; the reporting does not state its purpose.

The link is the stronger disguise. The Register describes the destination as a near-identical copycat of the vendor's tenant inside an attacker-controlled Microsoft 365 workspace. Because the host is still sharepoint.com, the email is less likely to be flagged. A reader checking the link text sees the vendor; the real address is still a SharePoint address.

What is ARToken and how is it related to EvilTokens?

ARToken is a phishing-as-a-service operator panel, titled "ARToken Panel" and built as a React web application. Help Net Security reports that researchers found it during an incident response engagement and that it exposes more than eighty endpoints covering device code phishing, token persistence, mailbox access, business email compromise and SharePoint theft.

BleepingComputer reports that the platform "appears to operate as an affiliate of the EvilTokens phishing platform". It uses an identical POST /api/device/start call to start the device code flow, the same Primary Refresh Token endpoints (setup, refresh, renewal and reacquisition) and a similar Cloudflare Workers deployment model. The Register adds that the API contract matches the one first documented for EvilTokens, and that ARToken appears to be an EvilTokens customer. A researcher quoted by Help Net Security said it "does appear to be more of an affiliate's customized build than anything else".

How big is EvilTokens?

Help Net Security describes EvilTokens as a subscription phishing service that spread across hundreds of Cloudflare Workers domains and runs an AI-assisted business email compromise pipeline in its second stage. It was first documented in March 2026. The Register reports that a Microsoft vice president of security research said: "Since March 15, 2026, we have observed 10 to 15 distinct campaigns launching every 24 hours." Each campaign targets hundreds of organizations with varied payloads. BleepingComputer, citing Push Security, reports that device code phishing attacks rose 37-fold over the past year.

What device code phishing abuses

The OAuth 2.0 Device Authorization Grant (RFC 8628) is a sign-in flow built for devices without a keyboard. BleepingComputer reports that victims enter a legitimate Microsoft-issued code on Microsoft's real sign-in page, and Microsoft then issues the tokens to the attacker. Authentication happens on Microsoft's infrastructure, so MFA can be bypassed. For a different device code kit with a different delivery method, see AegisAI's Wazza analysis.

What the operator gets after a token is captured

BleepingComputer reports that the panel goes well beyond a phishing page. Reverse engineering of its client-side JavaScript showed these capabilities:

Help Net Security adds that operators can escalate tokens into PRTs that survive password resets, and that a companion Windows tool opens a victim's Microsoft 365 session outside the panel. The Register quotes the researcher's conclusion: "it is a complete BEC operations environment."

How does the seven-layer anti-bot check keep scanners away from the lure?

Help Net Security reports that the phishing page runs seven layers of checks before it serves the device code lure. It describes two groups. Early checks read browser traits to screen out headless browsers, automation tools and crawlers. Later checks hold the payload back until mouse movement or a screen touch is detected and a short delay after page load has passed. The payload is scrambled and unpacks only in the browser.

The Register reports that researchers found the evasion capabilities "notably more sophisticated" than what had been seen from EvilTokens. In AegisAI's assessment, the effect is that an automated scanner is shown an inert page while a person with a mouse is shown the lure. The reporting does not list the individual layers.

Is ARToken still active?

Help Net Security reports that the panel researchers examined was no longer accessible when the first reports ran. A researcher quoted there said no takedown had been coordinated, and that the panel was "likely moved".

The Hacker News reported in its 26 October 2026 weekly recap, citing a security vendor's research, a campaign built on an updated version of ARToken. Spoofed emails urged recipients to review a request for proposal document or a payment invoice. The link led to a compromised SharePoint tenant hosting a .URL file that pointed to content on Google Sites, which then redirected victims to a Cloudflare Workers-hosted URL serving the device code lure. The lure's obfuscated JavaScript included anti-analysis checks designed to detect virtualized and automated browsing environments, a hardcoded URL for the ARToken backend panel and a polling-path variant that differs from the endpoints described in the earlier reporting.

Indicators

Why standard controls miss it

Each layer a defender usually leans on sees something that looks normal.

How AegisAI protects against it

The lures in the reporting were emails: two invoice messages in the original sample and request-for-proposal and invoice messages in the later campaign. The approach below applies to both.

Aegis does not classify infrastructure. It classifies intent. A lure with no attacker-owned infrastructure still has to ask the recipient to do something on the attacker's behalf, and that request is what gets classified, independent of how clean the destination URL is.

AegisAI's agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it.

When a lure or a compromised session is caught, the response compounds: the message is withheld at classification, copies already delivered are retracted, rewritten links refuse a late visit, the account's outbound and internal mail gets rescanned, and lateral phishing attempts to colleagues are blocked at the same bar rather than treated as a fresh, unrelated message.

More on how that works: inbound email security.

What the reporting does not tell us

Scale. The reporting gives no victim count specific to ARToken. It is unclear how large the affiliate's operation is next to the wider EvilTokens platform.

Delivery. The reporting describes two emails from one engagement. It does not show how many organizations received ARToken lures, or whether the invoice theme is the only one in use.

The anti-bot layers. Help Net Security says there are seven but describes only two groups, so the full list is not in the public reporting reviewed here.

The October campaign. The Hacker News item is a recap entry citing one vendor's research. It does not give a victim count, a date for the activity or the lure recipients.

Indicators. The panel moved after the first reports and the later variant uses different polling paths, so published hostnames should be treated as aged.

MITRE ATT&CK mapping

Recommendations for defenders

FAQ

References