ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365

Cisco Talos details ARToken, a fully-featured phishing-as-a-service platform tied to EvilTokens that uses Microsoft OAuth device-code phishing to capture access and Primary Refresh Tokens, deploys lures via Cloudflare Workers, employs a sophisticated seven-layer client-side anti-analysis stack, and provides affiliates with BEC, SharePoint/OneDrive exfiltration, token management, and session browsing capabilities; the report includes API and SPA analysis, IOCs, and MITRE ATT&CK mappings.