The ARToken phishing panel targets Microsoft 365 accounts

The report details Cisco Talos analysis of ARToken, an affiliate-customized build of the EvilTokens phishing platform that uses Microsoft’s OAuth device authorization flow to capture tokens (including Primary Refresh Tokens) and bypass multi-factor authentication; operators use look-alike SharePoint lures, Cloudflare Workers domains, and an exposed React management panel to automate mailbox access, file theft, and business email compromise at scale (hundreds of domains), and Talos published domains (e.g., pamconj.com) for defenders to hunt on.