EvilTokens device-code phishing kit totally more evil than we all thought

1. Executive summary

The EvilTokens phishing-as-a-service (PhaaS) platform, which abuses Microsoft's OAuth 2.0 Device Authorization Grant (RFC 8628) to bypass MFA and silently capture victim tokens for Microsoft 365 access, has been linked to a more mature affiliate operation branded "ARToken" via shared infrastructure, identical API contracts, and overlapping deployment patterns. Cisco Talos incident responders documented targeted email lures abusing real vendor relationships (outstanding-invoice theme) to deliver victims to attacker-controlled but legitimate-appearing sharepoint.com tenants, alongside a comprehensive post-exploitation toolkit including full Outlook inbox read/send access, inbox rule creation for forwarding and deletion, and keyword-based monitoring across all compromised accounts. Attribution to "EvilTokens" and "ARToken" is unconfirmed — neither actor has a MITRE ATT&CK profile. EMEA financial services organisations with Microsoft 365 tenants — particularly accounts-payable and finance functions — are at direct risk of token theft, persistent session hijacking, and business email compromise (BEC).

2. Regulatory framing

3. Technical analysis & attack chain

Attack chain (confirmed steps)

1. Initial lure delivery. A targeted email is sent to an accounts-payable recipient at the target organisation, spoofing a legitimate vendor contact. Talos recovered two near-identical messages sent ~4 minutes apart on 2026-04-20. The email abuses a real vendor relationship (a US life-sciences company and a Wisconsin plumbing/fire-protection contractor). The From header presents the contractor's genuine domain; the Reply-To redirects to an unrelated attacker-controlled domain. The lure theme is an outstanding-invoice query: "the following invoices appear to still be outstanding…".
2. Lure link construction. The visible anchor text in the email body displays the vendor's genuine SharePoint tenant name. The actual href points to a near-identical look-alike tenant — the vendor's name with .com folded into the tenant label — under a different attacker-controlled Microsoft 365 workspace. Example URL from Talos: https[:]//mononapfpcom.sharepoint[.]com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEc. Because the destination is a genuine sharepoint.com host, it inherits SharePoint's clean reputation and is less likely to be flagged as a phish by email security gateways.
3. Client-side anti-analysis gauntlet. The phishing page deploys a seven-layer behavioural verification stack before enabling the device-code payload:

This is described as "notably more sophisticated" than the server-side X-Antibot-Token mechanism documented in earlier Sekoia research.

4. Device-code flow execution. The page presents a device-code authentication prompt leveraging Microsoft's OAuth 2.0 Device Authorization Grant (RFC 8628). The victim is social-engineered into completing the device-code flow, which silently authenticates the attacker as the victim to the organisation's Microsoft 365 applications — bypassing MFA entirely because the device-code flow is a legitimate Microsoft authentication mechanism.
5. Token capture and persistence. Upon completion, the attacker captures the victim's OAuth token. Microsoft's April 2026 reporting confirmed the post-compromise pipeline includes automated device registration for persistent access. The ARToken panel provides token management and persistence mechanisms.
6. Post-exploitation — BEC toolkit. The ARToken panel includes a comprehensive BEC operations environment with: - Full Microsoft Outlook inbox read access - Email sending capabilities as the victim - Inbox rule creation for forwarding and deleting messages - Keyword-based monitoring across all compromised accounts

This represents a full BEC operations environment, not a simple phishing kit.

7. AI-augmented BEC pipeline (EvilTokens platform-level). Sekoia's Part 2 research documented an AI-augmented BEC pipeline chaining Groq-hosted Llama models for financial exposure scoring and GPT-4o-mini for email translation, producing three tailored BEC scenarios per compromised mailbox.

Infrastructure details

• Management panel: dashboard-bl.pamconj[.]com — serves a React single-page application (SPA) with a 1.7MB compiled JavaScript bundle. Page title: "ARToken Panel." The SPA architecture exposes all client-side code (routes, UI labels, component logic, API endpoint paths) in the JavaScript bundle regardless of authentication state — no credentials were required or bypassed to access this code.
• C2 API: spx.pamconj[.]com
• Phishing deployment: Cloudflare Workers accounts including clear90489058903-document.workers[.]dev
• EvilTokens scale (per Sekoia): ~500 Cloudflare Workers domains and over 1,000 total phishing pages. Microsoft confirmed 10–15 distinct campaigns per 24 hours, each targeting hundreds of organisations, since 2026-03-15.
• Pricing model: $1,500 one-time plus $500/month; standalone "Portal Browser" for $500 lifetime.

Attribution confidence caveat

Attribution to "EvilTokens" and "ARToken" is unconfirmed — neither actor has a MITRE ATT&CK profile in the verified reference data. The connection between ARToken and EvilTokens rests on multiple overlapping technical indicators (identical API contract to Sekoia's original documentation, matching deployment and operational models, shared infrastructure patterns) identified by Cisco Talos. This is single-sourced (Cisco Talos IR engagement); the ARToken–EvilTokens link should be verified before enforcement actions targeting the broader EvilTokens infrastructure.

4. Mitigation & containment

P1 — Within 24 hours

1. Block known infrastructure at email gateway, DNS, firewall, and proxy: - dashboard-bl.pamconj[.]com - spx.pamconj[.]com - clear90489058903-document.workers[.]dev - mononapfpcom.sharepoint[.]com (look-alike tenant — verify against your legitimate SharePoint tenants before blocking)
2. Deploy mail-flow rules to quarantine or tag: - Emails where Reply-To domain differs from From domain - Emails containing the string "the following invoices appear to still be outstanding" from external senders to accounts-payable distribution lists - Emails with anchor text containing "sharepoint" where the href domain does not match your organisation's verified SharePoint tenant
3. Conditional Access — restrict device-code flow: - In Microsoft Entra ID (Azure AD), evaluate Conditional Access policies to restrict or block the device authorization grant flow for non-managed/non-compliant devices. If business justification exists, limit to specific groups only. - Monitor Entra ID sign-in logs for authenticationProtocol = deviceCode and alert on any occurrences from unexpected users or locations.
4. Audit existing inbox rules organisation-wide: - Run Microsoft Graph / Exchange PowerShell to enumerate all forwarding and deletion rules across mailboxes, prioritising accounts-payable and finance users. - Flag rules forwarding to external domains or containing deletion actions on inbound mail.

P2 — Within 72 hours

5. Hunt for compromised sessions: - Query Microsoft Graph audit logs for SignInLogs where authenticationDetails indicates device-code flow (RequestType: deviceCode). - Query MailItemsAccessed operations in Microsoft Purview for unusual read patterns from unfamiliar IP ranges or client apps. - Review Entra ID DeviceRegistration events for unexpected device registrations following suspicious sign-ins.
6. Revoke tokens for high-risk users: - For accounts-payable, finance, HR, and logistics personnel (the documented target profiles), consider proactive token revocation (Revoke-AzureADUserAllRefreshToken or Graph API revokeSignInSessions) during a planned communication window, forcing re-authentication.
7. EDR / endpoint detection: - Alert on browser processes navigating to *.workers.dev domains from corporate endpoints. - Alert on clipboard or browser content containing device-code patterns (8-character alphanumeric codes presented in the context of Microsoft authentication).

P3 — Within 7 days

8. User awareness — targeted training: - Deliver focused phishing simulation to AP/finance teams using invoice-lure templates with SharePoint look-alike links. - Train staff to verify the full href target of SharePoint links, not just the anchor text.
9. Microsoft 365 hardening: - Enmark or disable legacy authentication protocols where device-code flow is not required. - Implement Entra ID Continuous Access Evaluation (CAE) to shorten token lifetimes and reduce the window of opportunity for stolen tokens. - Review and tighten SharePoint external sharing settings at tenant level.
10. Threat intelligence feed subscription:
    • Subscribe to feeds tracking EvilTokens/ARToken infrastructure for ongoing IOC updates, as the platform rotates Cloudflare Workers domains frequently.

5. Indicators of compromise

domain  dashboard-bl.pamconj[.]com
domain  spx.pamconj[.]com
domain  clear90489058903-document.workers[.]dev
url  https[:]//mononapfpcom.sharepoint[.]com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEc
string  the following invoices appear to still be outstanding
string  ARToken Panel
string  X-Antibot-Token

6. Detection

YARA rule

rule ARToken_Phishing_Panel_Javascript_Bundle {
    meta {
        author = "Adverse Trace"
        date = "2026-07-02"
        reference = "https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/"
        description = "Detects ARToken panel JavaScript bundle artefacts associated with EvilTokens affiliate infrastructure"
    }
    strings:
        $panel_title = "ARToken Panel" ascii nocase
        $antibot = "X-Antibot-Token" ascii
        $navigator_webdriver = "navigator.webdriver" ascii
        $puppeteer = "puppeteer" ascii nocase
        $playwright = "playwright" ascii nocase
        $selenium = "selenium" ascii nocase
        $interaction_telemetry = "mouse" ascii nocase
        $timing_gate = "800" ascii
    condition:
        $panel_title and 3 of ($antibot, $navigator_webdriver, $puppeteer, $playwright, $selenium, $interaction_telemetry, $timing_gate)
}

Sigma rule

title: Suspicious Device-Code Authentication Sign-In via Entra ID
id: 8d2f3a1e-4b5c-6d7e-9f0a-1b2c3d4e5f6a
status: experimental
description: >
    Detects Microsoft Entra ID sign-in events using the OAuth 2.0 Device Authorization Grant
    (device-code flow), which is abused by the EvilTokens/ARToken phishing kit to bypass MFA.
    Reference: https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/
author: Adverse Trace
date: 2026/07/02
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        properties.authenticationProtocol: deviceCode
    filter_known_service_accounts:
        userPrincipalName:

            - "svc_*@*"
            - "service-*@*"
    condition: selection and not filter_known_service_accounts
falsepositives:

    - Legitimate device-code authentication from managed devices (e.g., IoT, CLI tools, smart TVs)
    - Service accounts explicitly approved for device-code flow
level: high

title: Suspicious Email with Mismatched From and Reply-To Domains
id: a1b2c3d4-e5f6-789a-bcde-f0123456789a
status: experimental
description: >
    Detects inbound emails where the Reply-To domain differs from the From domain,
    a technique used by the ARToken/EvilTokens phishing kit in invoice-lure campaigns.
    Reference: https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/
author: Adverse Trace
date: 2026/07/02
logsource:
    product: microsoft365
    service: exchange
detection:
    selection_subject:
        subject|contains:

            - "invoice"
            - "outstanding"
    selection_body:
        body|contains:

            - "the following invoices appear to still be outstanding"
    condition: selection_subject and selection_body
falsepositives:

    - Legitimate vendor invoice reminders (verify Reply-To domain matches From domain)
level: medium

title: Creation of Inbox Forwarding or Deletion Rule Following Suspicious Sign-In
id: c3d4e5f6-a7b8-9cde-f012-3456-789a-bcde
status: experimental
description: >
    Detects creation of Exchange inbox rules that forward to external domains or delete messages,
    a post-exploitation capability of the ARToken BEC toolkit. Correlate with device-code sign-in alerts.
    Reference: https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/
author: Adverse Trace
date: 2026/07/02
logsource:
    product: microsoft365
    service: exchange
detection:
    selection_action:
        operationName: "Set-InboxRule"
    selection_forward:
        parameters|contains:

            - "ForwardTo"
            - "RedirectTo"
            - "DeleteMessage"
    condition: selection_action and selection_forward
falsepositives:

    - Legitimate user-created forwarding rules (e.g., personal email forwarding)
    - IT-administrative rules for shared mailbox management
level: high

7. Sources

• The Register — EvilTokens device-code phishing kit totally more evil than we all thought — https://www.theregister.com/cyber-crime/2026/07/01/eviltokens-device-code-phishing-kit-totally-more-evil-than-we-all-thought/5265409 — 2026-07-01
• Cisco Talos — ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365 — https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/ — 2026-07-01
• Help Net Security — The ARToken phishing panel targets Microsoft 365 accounts — https://www.helpnetsecurity.com/2026/07/01/artoken-phishing-panel-microsoft-365-accounts/ — 2026-07-01
• ESET WeLiveSecurity — EvilTokens: A phishing attack that doesn't steal your password — https://www.welivesecurity.com/en/cybercrime/eviltokens-phishing-doesnt-steal-password/ — 2026 (date not specified in source)

8. Adverse Trace position

This is a high-severity threat for EMEA financial services organisations using Microsoft 365. The device-code flow is a legitimate Microsoft authentication mechanism that cannot be "patched" — the attack abuses the protocol by design, not a vulnerability. The ARToken panel's BEC toolkit (inbox read/send, rule creation, keyword monitoring) combined with AI-augmented financial exposure scoring represents a full post-compromise operations environment, not a simple phishing kit. The seven-layer client-side anti-analysis gauntlet effectively defeats automated URL-scanning and sandbox detonation, meaning traditional email security controls will have limited efficacy against the phishing pages themselves. The most effective defensive layers are: (1) email gateway rules targeting the From/Reply-To mismatch and invoice-lure language; (2) Entra ID monitoring and restriction of device-code sign-ins; and (3) proactive inbox-rule auditing. Attribution to "EvilTokens" and "ARToken" is unconfirmed (no MITRE ATT&CK profiles); the ARToken–EvilTokens link is single-sourced to Cisco Talos — verify before enforcement against the broader EvilTokens infrastructure. Adverse Trace will continue monitoring for new Cloudflare Workers domains, additional affiliate panels, and any confirmed MITRE ATT&CK mapping. We will issue a update if attribution is confirmed or a if active exploitation against EMEA financial sector clients is identified.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.