Catan and Mouse

1. Executive summary

Cisco Talos published research on ARToken, a phishing-as-a-service (PhaaS) operator panel that shares infrastructure, API contracts, and operational patterns with the EvilTokens platform documented by Sekoia and Microsoft in early 2026. ARToken exposes 80+ API endpoints for device code phishing, Primary Refresh Token (PRT) persistence, business email compromise (BEC), and SharePoint exfiltration via a React-based dashboard — constituting a complete BEC operations environment rather than a simple phishing kit. Separately, Talos flagged CVE-2026-48558 (CVSS 9.5 CRITICAL, CWE-347 — Improper Verification of Cryptographic Signature), an authentication bypass in SimpleHelp RMM's OpenID Connect flow that is in CISA KEV (added 2026-06-29) and has been exploited for malware delivery. EMEA financial services with Microsoft 365 estates and RMM tooling should treat both as active, targeted threats.

2. Regulatory framing

3. Technical analysis & attack chain

A. ARToken / EvilTokens PhaaS platform

Attribution: No named threat actor with a MITRE ATT&CK profile is identified in the source material. The connection between ARToken and EvilTokens is based on overlapping infrastructure, API contracts, and operational patterns — attribution to a specific actor is unconfirmed. The ARToken panel was identified during a Talos IR engagement; this is single-sourced (Cisco Talos only). The Register and Help Net Security corroborate the Talos findings but do not provide independent primary research.

Attack chain (confirmed steps from source material)

1. Initial lure delivery. Targeted email spoofing an accounts-payable contact at a legitimate Wisconsin contractor, sent to an accounts-payable recipient at a U.S. life-sciences company. Two near-identical messages sent ~4 minutes apart on April 20, 2026. The "from" header presents the contractor's real domain; the reply-to redirects to an unrelated domain. Lure theme: outstanding-invoice query.
2. Phishing link. Visible anchor text displays the vendor's genuine SharePoint tenant name. The actual href points to an attacker-controlled Microsoft 365 workspace with a look-alike tenant name (vendor name with .com folded into the tenant label): https[:]//mononapfpcom.sharepoint[.]com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEc. Because the destination is a genuine sharepoint.com host, it inherits SharePoint's clean reputation.
3. Anti-analysis and evasion. The phishing page deploys seven layers of client-side behavioural verification: - User-Agent regex blocking headless browsers, Selenium, Puppeteer, Playwright, crawlers, wget, curl - navigator.webdriver check detecting automation frameworks - Browser feature fingerprinting (missing window.chrome, navigator.vendor, touch/mouse APIs) - Window dimension analysis (catches 0x0 outer dimensions from headless defaults) - Interaction telemetry requiring 3+ mouse moves or 1+ touch events before enabling payload - Timing gate: minimum 800ms elapsed since page load - Movement pattern analysis validating non-linear mouse coordinate trajectories
4. Device code phishing. The platform abuses Microsoft's OAuth 2.0 Device Authorization Grant (RFC 8628) to capture victim tokens while bypassing MFA entirely.
5. Post-compromise persistence. Capabilities exposed through 80+ API endpoints include: - Primary Refresh Token (PRT) persistence - Full Microsoft Outlook inbox read access - Email sending as the victim - Inbox rule creation for forwarding and deleting messages - Keyword-based monitoring across all compromised accounts - SharePoint exfiltration - Automated device registration for persistent access (documented by Microsoft)
6. BEC pipeline. EvilTokens' second-stage capabilities (documented by Sekoia Part 2) include an AI-augmented BEC pipeline chaining Groq-hosted Llama models for financial exposure scoring and GPT-4o-mini for email translation, producing three tailored BEC scenarios per compromised mailbox.

Infrastructure

• Management panel: dashboard-bl.pamconj[.]com — serves a React SPA with a 1.7MB compiled JavaScript bundle; page title "ARToken Panel"
• C2 API: spx.pamconj[.]com
• Phishing deployment: Cloudflare Workers accounts including clear90489058903-document.workers[.]dev
• EvilTokens umbrella (per Sekoia): ~500 Cloudflare Workers domains, 1,000+ total phishing pages
• Platform pricing: $1,500 one-time + $500/month; standalone "Portal Browser" $500 lifetime

Scale: Microsoft reported 10–15 distinct campaigns per 24 hours since March 15, 2026, each targeting hundreds of organizations. Targeted sectors include finance professionals, HR staff, and logistics personnel globally.

SPA exposure note: The React SPA architecture exposes all client-side code including routes, UI labels, component logic, and API endpoint paths in the JavaScript bundle regardless of authentication state — no credentials were required to enumerate the panel's functionality.

B. CVE-2026-48558 — SimpleHelp RMM authentication bypass

Verified reference data: CVSS 9.5 CRITICAL — IN CISA KEV (added 2026-06-29) — EPSS 1% — CWE-347 (Improper Verification of Cryptographic Signature).

Source discrepancy note: The source text (Security Week via Talos newsletter) describes the vulnerability as an "authentication bypass" in SimpleHelp's "OpenID Connect authentication flow" allowing a remote attacker to "obtain a fully authenticated technician session." The verified CWE-347 classification (Improper Verification of Cryptographic Signature) is consistent with an authentication bypass where a cryptographic signature is improperly verified — both classifications describe the same flaw class. We use the verified CVSS 9.5 and CWE-347.

Technical detail from source: The vulnerability impacts SimpleHelp's OpenID Connect authentication flow and allows a remote, unauthenticated attacker to obtain a fully authenticated technician session. The bug has been exploited for malware delivery. No specific SimpleHelp versions, file paths, or exploit payloads are provided in the source material.

Confidence caveat: Technical detail on CVE-2026-48558 is single-sourced (Security Week summary of the Talos newsletter). No vendor advisory, exploit code, or affected version list is present in the provided sources. Verify against the SimpleHelp vendor advisory before enforcement.

C. Additional threats noted in source material

• Password-spraying campaign: 81+ million login attempts over two weeks against Microsoft 365 environments via Azure CLI using breach-exposed credentials (BleepingComputer — single-sourced).
• AI agent exploitation: Threat actors leveraging misconfigured or exposed enterprise AI agent endpoints to facilitate sophisticated attacks (DarkReading — single-sourced).

D. File reputation indicators (Talos)

The source material includes five file reputation entries. These are general Talos threat intelligence samples, not directly linked to ARToken or CVE-2026-48558 in the source text. They are included below as provided.

4. Mitigation & containment

ARToken / EvilTokens

P1 — Within 24 hours

1. Block the following domains at email gateway, DNS sinkhole, proxy, and firewall: - pamconj.com (and all subdomains: dashboard-bl.pamconj.com, spx.pamconj.com) - clear90489058903-document.workers.dev - mononapfpcom.sharepoint.com (attacker-controlled tenant — exercise caution: this is a legitimate sharepoint.com subdomain; block at email gateway URL filtering rather than blanket-blocking all sharepoint.com)
2. Search Microsoft 365 audit logs for: - Inbox rule creation (operations: New-InboxRule, Set-InboxRule) — especially rules with forwarding actions or delete-on-read - Device registration events (Add device, Update device) following suspicious sign-ins - OAuth device code grant sign-ins (sign-in event type: interactiveRefreshToken, client app: Microsoft Authentication Manager or similar device-code flows) - Mailbox access from unusual IP/geolocation - SharePoint file downloads or external sharing
3. Review Conditional Access policies: block device code flow (deviceCode client application) for non-admin users where feasible; require compliant device for all sign-ins.

P2 — Within 72 hours

4. Hunt for BEC indicators: emails sent from compromised accounts to external financial contacts, especially containing invoice/payment/wire language. Search for auto-forwarding rules to external domains.
5. Revoke all refresh tokens and PRTs for accounts showing suspicious device-code sign-ins: Revoke-AzureADUserAllRefreshToken (MSOnline) or equivalent Microsoft Graph API call.
6. Deploy mail-flow rules to flag or quarantine emails where the sender display name matches a known vendor but the reply-to domain differs from the from domain.
7. Block or alert on Cloudflare Workers *.workers.dev domains at web proxy where business justification is absent.

P3 — Within 7 days

8. Conduct a targeted phishing simulation for accounts-payable and finance staff using invoice-lure templates.
9. Review and tighten SharePoint external sharing settings at tenant level.
10. Implement detection for the seven anti-analysis behavioural checks in web proxy/IDS — specifically, flag requests to sharepoint.com tenants that include User-Agent strings consistent with the blocking regex patterns (the page blocks automation tools; defenders can invert this to detect infrastructure that behaves this way).

CVE-2026-48558 — SimpleHelp RMM

P1 — Within 24 hours

1. Identify all SimpleHelp installations in the estate. Check for internet-exposed technician consoles.
2. If SimpleHelp is deployed: isolate the SimpleHelp server from the internet immediately (restrict to VPN or internal network only) pending patching.
3. Review SimpleHelp session logs for unauthenticated or anomalous technician session creation.

P2 — Within 72 hours

4. Apply the vendor patch once available. No vendor fix version is specified in the source material — check the SimpleHelp vendor advisory directly.
5. If patching is not immediately possible, place SimpleHelp behind a reverse proxy with strong authentication (mTLS or IP allowlisting) as a compensating control.
6. Audit all technician sessions since the CISA KEV addition date (2026-06-29) for indicators of exploitation.

P3 — Within 7 days

7. Assess whether SimpleHelp is an ICT third-party provider under DORA Art. 28 and update contractual provisions (DORA Art. 30) to require vulnerability remediation SLAs.
8. Evaluate RMM concentration risk (DORA Art. 29) if SimpleHelp manages a significant portion of the estate.

5. Indicators of compromise

domain  pamconj.com
domain  dashboard-bl.pamconj.com
domain  spx.pamconj.com
domain  clear90489058903-document.workers.dev
url  https[:]//mononapfpcom.sharepoint[.]com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEc
sha256  9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
md5  2915b3f8b703eb744fc54c81f4a9c67f
filename  VID001.exe
sha256  9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f
md5  38de5b216c33833af710e88f7f64fc98
filename  sample.exe
sha256  afc8a00883a4ea07df2dc1d4ed02f8a23b35c9456413b438a2d9ce3ae5076638
md5  cc4d231df34e57f59eb970353c7d9de2
filename  AutoPico.exe
sha256  c0ad494457dcd9e964378760fb6aca86a23622045bca851d8f3ab49ec33978fe
md5  bf9672ec85283fdf002d83662f0b08b7
filename  f_000cd7.html
sha256  853baab97b1f3b03c1ffa55797e87867f5fb7ce33457411f56afd270cb395453
md5  41acb30b9d662d48b7b4fc0ac3d4b79f
filename  SignInfoConsole.exe

6. Detection

YARA rule — ARToken panel JavaScript bundle

rule ARToken_Panel_Bundle {
    meta {
        author = "Adverse Trace"
        date = "2026-07-02"
        reference = "https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/"
        description = "Detects ARToken PhaaS panel React SPA bundle by distinctive strings"
    }
    strings:
        $panel_title = "ARToken Panel" ascii
        $domain_pamconj = "pamconj.com" ascii
        $domain_dashboard = "dashboard-bl.pamconj.com" ascii
        $domain_spx = "spx.pamconj.com" ascii
        $workers_dev = "clear90489058903-document.workers.dev" ascii
        $sharepoint_lure = "mononapfpcom.sharepoint.com" ascii
        $nav_webdriver = "navigator.webdriver" ascii
        $anti_bot = "X-Antibot-Token" ascii
    condition:
        3 of them
}

YARA rule — Talos file reputation samples

rule Talos_FileRep_Samples {
    meta {
        author = "Adverse Trace"
        date = "2026-07-02"
        reference = "https://blog.talosintelligence.com/catan-and-mouse/"
        description = "Detects file samples from Talos Threat Source newsletter 2026-07-02"
    }
    strings:
        $filename_vid001 = "VID001.exe" ascii
        $filename_sample = "sample.exe" ascii
        $filename_autopico = "AutoPico.exe" ascii
        $filename_signinfo = "SignInfoConsole.exe" ascii
        $filename_html = "f_000cd7.html" ascii
        $detection_coinminer = "Win.Worm.Coinminer::1201" ascii
        $detection_procpatcher = "Win.Tool.Procpatcher::1201" ascii
        $detection_kms = "PUA.Win.Tool.Kmsactivator::1201" ascii
    condition:
        2 of them
}

Sigma rule — Suspicious inbox rule creation (BEC persistence)

title: Suspicious Inbox Rule Creation Indicative of BEC Platform
id: 6d4f2a1e-9b3c-4e8a-b5f2-0c1d7e9f3a2b
status: experimental
description: Detects creation of inbox forwarding or deletion rules that may indicate ARToken/EvilTokens BEC persistence
author: Adverse Trace
date: 2026/07/02
references:

  - https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/
logsource:
    product: microsoft365
    service: audit
detection:
    selection:
        operation|contains:

            - "New-InboxRule"
            - "Set-InboxRule"
        parameters|contains:

            - "ForwardTo"
            - "DeleteMessage"
            - "MoveToFolder"
    filter_legitimate:
        parameters|contains:

            - "JunkEmail"
            - "Deleted Items"
    condition: selection and not filter_legitimate
falsepositives:

    - Legitimate user inbox rule creation
    - IT-administrative rule deployment
level: high

Sigma rule — Device code flow sign-in (MFA bypass)

title: OAuth Device Code Grant Sign-In — Potential MFA Bypass
id: 8c2e1f3d-4a5b-6c7d-8e9f-0a1b-2c3d4e5f
status: experimental
description: Detects device code flow authentication events that may indicate EvilTokens/ARToken phishing
author: Adverse Trace
date: 2026/07/02
references:

    - https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        authenticationProtocol: "deviceCode"
        clientApp|contains:

            - "Microsoft Authentication Manager"
            - "Device Code"
    condition: selection
falsepositives:

    - Legitimate device code authentication for IoT or headless devices
    - Legitimate development workflows using device code flow
level: medium

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• Cisco Talos — "Catan and Mouse" (Threat Source newsletter) — https://blog.talosintelligence.com/catan-and-mouse/ — 2026-07-02
• Cisco Talos — "ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365" — https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/ — 2026-07-01
• The Register — "EvilTokens device-code phishing kit totally more evil than we all thought" — https://www.theregister.com/cyber-crime/2026/07/01/eviltokens-device-code-phishing-kit-totally-more-evil-than-we-all-thought/5265409 — 2026-07-01
• Help Net Security — "The ARToken phishing panel targets Microsoft 365 accounts" — https://www.helpnetsecurity.com/2026/07/01/artoken-phishing-panel-microsoft-365-accounts/ — 2026-07-01
• Security Week — referenced via Talos newsletter for CVE-2026-48558 SimpleHelp RMM exploitation — 2026-07-02

8. Adverse Trace position

CVE-2026-48558 is CVSS 9.5 CRITICAL, in CISA KEV, and actively exploited for malware delivery — this is a high-priority remediation item for any client running SimpleHelp RMM. The EPSS of 1% suggests low widespread exploitation pressure but the CISA KEV listing and confirmed in-the-wild exploitation override that metric for prioritisation. The ARToken/EvilTokens platform represents a mature, well-funded PhaaS operation with documented success against finance-sector targets; its use of legitimate sharepoint.com infrastructure for phishing and its seven-layer anti-analysis stack make email-gateway and proxy-based detection insufficient as sole controls — clients need M365 audit-log monitoring for device-code sign-ins, inbox rule creation, and anomalous device registration. Attribution to a named actor is unconfirmed; the ARToken–EvilTokens connection is corroborated by infrastructure and API overlap but rests on single-source primary research from Talos. We will continue monitoring for additional IOCs, vendor advisories for SimpleHelp, and any MITRE ATT&CK group profiling. Clients with M365 estates should implement the P1 detections immediately and contact their Adverse Trace analyst for tailored hunt queries.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.