> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Catan and Mouse - URL: https://f4n6.co.uk/security-feed/catan-and-mouse/ - Published: 2026-07-02T19:02:33.000Z - Updated: 2026-07-02T19:02:33.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-48558 ## 1\. Executive summary Cisco Talos published research on ARToken, a phishing-as-a-service (PhaaS) operator panel that shares infrastructure, API contracts, and operational patterns with the EvilTokens platform documented by Sekoia and Microsoft in early 2026\. ARToken exposes 80+ API endpoints for device code phishing, Primary Refresh Token (PRT) persistence, business email compromise (BEC), and SharePoint exfiltration via a React-based dashboard — constituting a complete BEC operations environment rather than a simple phishing kit. Separately, Talos flagged CVE-2026-48558 (CVSS 9.5 CRITICAL, CWE-347 — Improper Verification of Cryptographic Signature), an authentication bypass in SimpleHelp RMM's OpenID Connect flow that is in CISA KEV (added 2026-06-29) and has been exploited for malware delivery. EMEA financial services with Microsoft 365 estates and RMM tooling should treat both as active, targeted threats. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17: ICT-related incident management process | ARToken BEC platform compromises Microsoft 365 mailboxes, creates inbox forwarding rules, and exfiltrates SharePoint data — a major ICT-related incident if detected in a client environment | Clients must have a process to detect, contain, and manage M365 compromise incidents including token-based persistence | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | CVE-2026-48558 is in CISA KEV and actively exploited for malware delivery; an RMM compromise at a financial institution would constitute a major ICT-related incident | If RMM compromise is confirmed, clients may have reporting obligations to competent authorities | | NIS2 Art. 21(2)(d): supply chain security measures | SimpleHelp is a third-party RMM component; CVE-2026-48558 exploitation represents a supply-chain risk via ICT third-party provider | Clients using SimpleHelp must assess and remediate the vulnerability as part of supply-chain security duties | | UK NIS 2018: UK Network and Information Systems Regulations — OES/RDSP duties | RMM software compromise can provide persistent access to managed endpoints, engaging OES/RDSP operational resilience duties | UK-regulated clients must ensure RMM platforms are patched and monitored under their OES/RDSP duties | ## 3\. Technical analysis & attack chain ### A. ARToken / EvilTokens PhaaS platform **Attribution:** No named threat actor with a MITRE ATT&CK profile is identified in the source material. The connection between ARToken and EvilTokens is based on overlapping infrastructure, API contracts, and operational patterns — attribution to a specific actor is **unconfirmed**. The ARToken panel was identified during a Talos IR engagement; this is **single-sourced** (Cisco Talos only). The Register and Help Net Security corroborate the Talos findings but do not provide independent primary research. ### Attack chain (confirmed steps from source material) 1. **Initial lure delivery.** Targeted email spoofing an accounts-payable contact at a legitimate Wisconsin contractor, sent to an accounts-payable recipient at a U.S. life-sciences company. Two near-identical messages sent \~4 minutes apart on April 20, 2026\. The "from" header presents the contractor's real domain; the reply-to redirects to an unrelated domain. Lure theme: outstanding-invoice query. 2. **Phishing link.** Visible anchor text displays the vendor's genuine SharePoint tenant name. The actual href points to an attacker-controlled Microsoft 365 workspace with a look-alike tenant name (vendor name with `.com` folded into the tenant label): `https[:]//mononapfpcom.sharepoint[.]com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEc`. Because the destination is a genuine `sharepoint.com` host, it inherits SharePoint's clean reputation. 3. **Anti-analysis and evasion.** The phishing page deploys seven layers of client-side behavioural verification: - User-Agent regex blocking headless browsers, Selenium, Puppeteer, Playwright, crawlers, wget, curl - `navigator.webdriver` check detecting automation frameworks - Browser feature fingerprinting (missing `window.chrome`, `navigator.vendor`, touch/mouse APIs) - Window dimension analysis (catches 0x0 outer dimensions from headless defaults) - Interaction telemetry requiring 3+ mouse moves or 1+ touch events before enabling payload - Timing gate: minimum 800ms elapsed since page load - Movement pattern analysis validating non-linear mouse coordinate trajectories 4. **Device code phishing.** The platform abuses Microsoft's OAuth 2.0 Device Authorization Grant (RFC 8628) to capture victim tokens while bypassing MFA entirely. 5. **Post-compromise persistence.** Capabilities exposed through 80+ API endpoints include: - Primary Refresh Token (PRT) persistence - Full Microsoft Outlook inbox read access - Email sending as the victim - Inbox rule creation for forwarding and deleting messages - Keyword-based monitoring across all compromised accounts - SharePoint exfiltration - Automated device registration for persistent access (documented by Microsoft) 6. **BEC pipeline.** EvilTokens' second-stage capabilities (documented by Sekoia Part 2) include an AI-augmented BEC pipeline chaining Groq-hosted Llama models for financial exposure scoring and GPT-4o-mini for email translation, producing three tailored BEC scenarios per compromised mailbox. ### Infrastructure - Management panel: `dashboard-bl.pamconj[.]com` — serves a React SPA with a 1.7MB compiled JavaScript bundle; page title "ARToken Panel" - C2 API: `spx.pamconj[.]com` - Phishing deployment: Cloudflare Workers accounts including `clear90489058903-document.workers[.]dev` - EvilTokens umbrella (per Sekoia): \~500 Cloudflare Workers domains, 1,000+ total phishing pages - Platform pricing: $1,500 one-time + $500/month; standalone "Portal Browser" $500 lifetime **Scale:** Microsoft reported 10–15 distinct campaigns per 24 hours since March 15, 2026, each targeting hundreds of organizations. Targeted sectors include finance professionals, HR staff, and logistics personnel globally. **SPA exposure note:** The React SPA architecture exposes all client-side code including routes, UI labels, component logic, and API endpoint paths in the JavaScript bundle regardless of authentication state — no credentials were required to enumerate the panel's functionality. ### B. CVE-2026-48558 — SimpleHelp RMM authentication bypass **Verified reference data:** CVSS 9.5 CRITICAL — IN CISA KEV (added 2026-06-29) — EPSS 1% — CWE-347 (Improper Verification of Cryptographic Signature). **Source discrepancy note:** The source text (Security Week via Talos newsletter) describes the vulnerability as an "authentication bypass" in SimpleHelp's "OpenID Connect authentication flow" allowing a remote attacker to "obtain a fully authenticated technician session." The verified CWE-347 classification (Improper Verification of Cryptographic Signature) is consistent with an authentication bypass where a cryptographic signature is improperly verified — both classifications describe the same flaw class. We use the verified CVSS 9.5 and CWE-347. **Technical detail from source:** The vulnerability impacts SimpleHelp's OpenID Connect authentication flow and allows a remote, unauthenticated attacker to obtain a fully authenticated technician session. The bug has been exploited for malware delivery. No specific SimpleHelp versions, file paths, or exploit payloads are provided in the source material. **Confidence caveat:** Technical detail on CVE-2026-48558 is **single-sourced** (Security Week summary of the Talos newsletter). No vendor advisory, exploit code, or affected version list is present in the provided sources. Verify against the SimpleHelp vendor advisory before enforcement. ### C. Additional threats noted in source material - **Password-spraying campaign:** 81+ million login attempts over two weeks against Microsoft 365 environments via Azure CLI using breach-exposed credentials (BleepingComputer — single-sourced). - **AI agent exploitation:** Threat actors leveraging misconfigured or exposed enterprise AI agent endpoints to facilitate sophisticated attacks (DarkReading — single-sourced). ### D. File reputation indicators (Talos) The source material includes five file reputation entries. These are general Talos threat intelligence samples, not directly linked to ARToken or CVE-2026-48558 in the source text. They are included below as provided. ## 4\. Mitigation & containment ### ARToken / EvilTokens ### P1 — Within 24 hours 1. Block the following domains at email gateway, DNS sinkhole, proxy, and firewall: - `pamconj.com` (and all subdomains: `dashboard-bl.pamconj.com`, `spx.pamconj.com`) - `clear90489058903-document.workers.dev` \- `mononapfpcom.sharepoint.com` (attacker-controlled tenant — exercise caution: this is a legitimate `sharepoint.com` subdomain; block at email gateway URL filtering rather than blanket-blocking all `sharepoint.com`) 2. Search Microsoft 365 audit logs for: - Inbox rule creation (operations: `New-InboxRule`, `Set-InboxRule`) — especially rules with forwarding actions or delete-on-read - Device registration events (`Add device`, `Update device`) following suspicious sign-ins - OAuth device code grant sign-ins (sign-in event type: `interactiveRefreshToken`, client app: `Microsoft Authentication Manager` or similar device-code flows) - Mailbox access from unusual IP/geolocation - SharePoint file downloads or external sharing 3. Review Conditional Access policies: block device code flow (`deviceCode` client application) for non-admin users where feasible; require compliant device for all sign-ins. ### P2 — Within 72 hours 1. Hunt for BEC indicators: emails sent from compromised accounts to external financial contacts, especially containing invoice/payment/wire language. Search for auto-forwarding rules to external domains. 2. Revoke all refresh tokens and PRTs for accounts showing suspicious device-code sign-ins: `Revoke-AzureADUserAllRefreshToken` (MSOnline) or equivalent Microsoft Graph API call. 3. Deploy mail-flow rules to flag or quarantine emails where the sender display name matches a known vendor but the reply-to domain differs from the from domain. 4. Block or alert on Cloudflare Workers `*.workers.dev` domains at web proxy where business justification is absent. ### P3 — Within 7 days 1. Conduct a targeted phishing simulation for accounts-payable and finance staff using invoice-lure templates. 2. Review and tighten SharePoint external sharing settings at tenant level. 3. Implement detection for the seven anti-analysis behavioural checks in web proxy/IDS — specifically, flag requests to `sharepoint.com` tenants that include User-Agent strings consistent with the blocking regex patterns (the page blocks automation tools; defenders can invert this to detect infrastructure that behaves this way). ### CVE-2026-48558 — SimpleHelp RMM ### P1 — Within 24 hours 1. Identify all SimpleHelp installations in the estate. Check for internet-exposed technician consoles. 2. If SimpleHelp is deployed: isolate the SimpleHelp server from the internet immediately (restrict to VPN or internal network only) pending patching. 3. Review SimpleHelp session logs for unauthenticated or anomalous technician session creation. ### P2 — Within 72 hours 1. Apply the vendor patch once available. **No vendor fix version is specified in the source material** — check the SimpleHelp vendor advisory directly. 2. If patching is not immediately possible, place SimpleHelp behind a reverse proxy with strong authentication (mTLS or IP allowlisting) as a compensating control. 3. Audit all technician sessions since the CISA KEV addition date (2026-06-29) for indicators of exploitation. ### P3 — Within 7 days 1. Assess whether SimpleHelp is an ICT third-party provider under DORA Art. 28 and update contractual provisions (DORA Art. 30) to require vulnerability remediation SLAs. 2. Evaluate RMM concentration risk (DORA Art. 29) if SimpleHelp manages a significant portion of the estate. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | --------- | -------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | -------------------- | | domain | pamconj.com | High — corroborated across Talos and The Register | Talos / The Register | | domain | dashboard-bl.pamconj.com | High — primary research | Talos | | domain | spx.pamconj.com | High — primary research | Talos | | domain | clear90489058903-document.workers.dev | High — primary research | Talos | | url | https\[:\]//mononapfpcom.sharepoint\[.\]com/:f:/g/IgAdH\_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEc | High — primary research | Talos | | sha256 | 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 | Medium — Talos file reputation, not directly linked to ARToken | Talos | | md5 | 2915b3f8b703eb744fc54c81f4a9c67f | Medium — Talos file reputation | Talos | | filename | VID001.exe | Medium — Talos file reputation | Talos | | detection | Win.Worm.Coinminer::1201 | Medium — Talos file reputation | Talos | | sha256 | 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f | Medium — Talos file reputation | Talos | | md5 | 38de5b216c33833af710e88f7f64fc98 | Medium — Talos file reputation | Talos | | filename | sample.exe | Medium — Talos file reputation | Talos | | detection | Win.Tool.Procpatcher::1201 | Medium — Talos file reputation | Talos | | sha256 | afc8a00883a4ea07df2dc1d4ed02f8a23b35c9456413b438a2d9ce3ae5076638 | Medium — Talos file reputation | Talos | | md5 | cc4d231df34e57f59eb970353c7d9de2 | Medium — Talos file reputation | Talos | | filename | AutoPico.exe | Medium — Talos file reputation | Talos | | detection | PUA.Win.Tool.Kmsactivator::1201 | Medium — Talos file reputation | Talos | | sha256 | c0ad494457dcd9e964378760fb6aca86a23622045bca851d8f3ab49ec33978fe | Medium — Talos file reputation | Talos | | md5 | bf9672ec85283fdf002d83662f0b08b7 | Medium — Talos file reputation | Talos | | filename | f\_000cd7.html | Medium — Talos file reputation | Talos | | detection | W32.C0AD494457-95.SBX.TG | Medium — Talos file reputation | Talos | | sha256 | 853baab97b1f3b03c1ffa55797e87867f5fb7ce33457411f56afd270cb395453 | Medium — Talos file reputation | Talos | | md5 | 41acb30b9d662d48b7b4fc0ac3d4b79f | Medium — Talos file reputation | Talos | | filename | SignInfoConsole.exe | Medium — Talos file reputation | Talos | | detection | W32.853BAAB97B.in12.Talos | Medium — Talos file reputation | Talos | ```iocs domain pamconj.com domain dashboard-bl.pamconj.com domain spx.pamconj.com domain clear90489058903-document.workers.dev url https[:]//mononapfpcom.sharepoint[.]com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEc sha256 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 md5 2915b3f8b703eb744fc54c81f4a9c67f filename VID001.exe sha256 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f md5 38de5b216c33833af710e88f7f64fc98 filename sample.exe sha256 afc8a00883a4ea07df2dc1d4ed02f8a23b35c9456413b438a2d9ce3ae5076638 md5 cc4d231df34e57f59eb970353c7d9de2 filename AutoPico.exe sha256 c0ad494457dcd9e964378760fb6aca86a23622045bca851d8f3ab49ec33978fe md5 bf9672ec85283fdf002d83662f0b08b7 filename f_000cd7.html sha256 853baab97b1f3b03c1ffa55797e87867f5fb7ce33457411f56afd270cb395453 md5 41acb30b9d662d48b7b4fc0ac3d4b79f filename SignInfoConsole.exe ``` ## 6\. Detection ### YARA rule — ARToken panel JavaScript bundle ```yara rule ARToken_Panel_Bundle { meta { author = "Adverse Trace" date = "2026-07-02" reference = "https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/" description = "Detects ARToken PhaaS panel React SPA bundle by distinctive strings" } strings: $panel_title = "ARToken Panel" ascii $domain_pamconj = "pamconj.com" ascii $domain_dashboard = "dashboard-bl.pamconj.com" ascii $domain_spx = "spx.pamconj.com" ascii $workers_dev = "clear90489058903-document.workers.dev" ascii $sharepoint_lure = "mononapfpcom.sharepoint.com" ascii $nav_webdriver = "navigator.webdriver" ascii $anti_bot = "X-Antibot-Token" ascii condition: 3 of them } ``` ### YARA rule — Talos file reputation samples ```yara rule Talos_FileRep_Samples { meta { author = "Adverse Trace" date = "2026-07-02" reference = "https://blog.talosintelligence.com/catan-and-mouse/" description = "Detects file samples from Talos Threat Source newsletter 2026-07-02" } strings: $filename_vid001 = "VID001.exe" ascii $filename_sample = "sample.exe" ascii $filename_autopico = "AutoPico.exe" ascii $filename_signinfo = "SignInfoConsole.exe" ascii $filename_html = "f_000cd7.html" ascii $detection_coinminer = "Win.Worm.Coinminer::1201" ascii $detection_procpatcher = "Win.Tool.Procpatcher::1201" ascii $detection_kms = "PUA.Win.Tool.Kmsactivator::1201" ascii condition: 2 of them } ``` ### Sigma rule — Suspicious inbox rule creation (BEC persistence) ```yaml title: Suspicious Inbox Rule Creation Indicative of BEC Platform id: 6d4f2a1e-9b3c-4e8a-b5f2-0c1d7e9f3a2b status: experimental description: Detects creation of inbox forwarding or deletion rules that may indicate ARToken/EvilTokens BEC persistence author: Adverse Trace date: 2026/07/02 references: - https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/ logsource: product: microsoft365 service: audit detection: selection: operation|contains: - "New-InboxRule" - "Set-InboxRule" parameters|contains: - "ForwardTo" - "DeleteMessage" - "MoveToFolder" filter_legitimate: parameters|contains: - "JunkEmail" - "Deleted Items" condition: selection and not filter_legitimate falsepositives: - Legitimate user inbox rule creation - IT-administrative rule deployment level: high ``` ### Sigma rule — Device code flow sign-in (MFA bypass) ```yaml title: OAuth Device Code Grant Sign-In — Potential MFA Bypass id: 8c2e1f3d-4a5b-6c7d-8e9f-0a1b-2c3d4e5f status: experimental description: Detects device code flow authentication events that may indicate EvilTokens/ARToken phishing author: Adverse Trace date: 2026/07/02 references: - https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/ logsource: product: azure service: signinlogs detection: selection: authenticationProtocol: "deviceCode" clientApp|contains: - "Microsoft Authentication Manager" - "Device Code" condition: selection falsepositives: - Legitimate device code authentication for IoT or headless devices - Legitimate development workflows using device code flow level: medium ``` ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)**, 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-48558](https://nvd.nist.gov/vuln/detail/CVE-2026-48558?ref=f4n6.co.uk) | 9.5 Critical | ⚠ KEV 2026-06-29 | 1% | SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC au… | ## 7\. Sources - Cisco Talos — "Catan and Mouse" (Threat Source newsletter) — https://blog.talosintelligence.com/catan-and-mouse/ — 2026-07-02 - Cisco Talos — "ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365" — https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/ — 2026-07-01 - The Register — "EvilTokens device-code phishing kit totally more evil than we all thought" — https://www.theregister.com/cyber-crime/2026/07/01/eviltokens-device-code-phishing-kit-totally-more-evil-than-we-all-thought/5265409 — 2026-07-01 - Help Net Security — "The ARToken phishing panel targets Microsoft 365 accounts" — https://www.helpnetsecurity.com/2026/07/01/artoken-phishing-panel-microsoft-365-accounts/ — 2026-07-01 - Security Week — referenced via Talos newsletter for CVE-2026-48558 SimpleHelp RMM exploitation — 2026-07-02 ## 8\. Adverse Trace position CVE-2026-48558 is CVSS 9.5 CRITICAL, in CISA KEV, and actively exploited for malware delivery — this is a high-priority remediation item for any client running SimpleHelp RMM. The EPSS of 1% suggests low widespread exploitation pressure but the CISA KEV listing and confirmed in-the-wild exploitation override that metric for prioritisation. The ARToken/EvilTokens platform represents a mature, well-funded PhaaS operation with documented success against finance-sector targets; its use of legitimate `sharepoint.com` infrastructure for phishing and its seven-layer anti-analysis stack make email-gateway and proxy-based detection insufficient as sole controls — clients need M365 audit-log monitoring for device-code sign-ins, inbox rule creation, and anomalous device registration. Attribution to a named actor is unconfirmed; the ARToken–EvilTokens connection is corroborated by infrastructure and API overlap but rests on single-source primary research from Talos. We will continue monitoring for additional IOCs, vendor advisories for SimpleHelp, and any MITRE ATT&CK group profiling. Clients with M365 estates should implement the P1 detections immediately and contact their Adverse Trace analyst for tailored hunt queries. --- [Read the original source →](https://blog.talosintelligence.com/catan-and-mouse/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*