Warning: ARToken Phishing Kit Automates BEC Attacks

Cisco Talos reports on ARToken, a phishing-as-a-service built on the EvilTokens framework that enables targeted social-engineering and BEC operations against Microsoft 365 tenants; the panel exposes 80+ API endpoints for device-code phishing, PRT persistence, Outlook inbox read/send and rule creation, keyword monitoring, attachment access, and SharePoint exfiltration, and employs a seven-layer client-side anti-analysis system to evade detection.