Microsoft 365 Phishing Panel Uses OAuth Device Code Flow to Capture Tokens and Persist Access

**ARToken phishing panel** — ARToken is a phishing-as-a-service panel that abuses Microsoft’s OAuth device code flow to steal M365 access and refresh tokens (bypassing passwords and MFA), provides a feature-rich operator dashboard for mailbox and SharePoint/OneDrive access and persistence, uses multi-layer evasion (fingerprinting, human verification), and is linked to the larger EvilTokens ecosystem; the report includes IoCs and defensive recommendations.