A sophisticated Phishing-as-a-Service platform called ARToken has emerged, targeting Microsoft 365 users. By weaponizing OAuth 2.0 Device Authorization Grants, the platform bypasses MFA to capture persistent access tokens, posing a critical security threat to enterprise tenants across the GCC region.
Target verification and AI-translated lures
Vendor impersonation & SharePoint look-alike tenants
7-layer client verification via Cloudflare Workers
Device Authorization Grant abuse (RFC 8628)
Token upgrade surviving password resets
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
June 30, 2026
A deep dive into the Bluekit and SnagX Phishing-as-a-Service platforms, analyzing how threat actors utilize Adversary-in-the-Middle reverse proxies to bypass multi-factor authentication and execute automated account takeovers targeting e-commerce credentials.
June 26, 2026
A targeted spearphishing campaign linked to Russian intelligence services focuses on stealing Signal Backup Recovery Keys. By exploiting the human layer, attackers reconstruct private messaging archives without breaking the underlying cryptographic protocol.
June 3, 2026
The emergence of the HeartSender V6 platform leak highlights the ongoing risks of mass-email delivery tools in the wild. We analyze the implications and provide defensive strategies.
Microsoft 365 cloud environments and enterprise user identities are the central targets of a highly specialized Phishing-as-a-Service platform known as ARToken. Closely linked to the infamous EvilTokens ecosystem, this framework bypasses traditional Multi-Factor Authentication protocols by weaponizing OAuth 2.0 Device Authorization Grants (RFC 8628). Unlike legacy phishing kits that simply harvest static credentials, ARToken enables adversary groups to hijack active authentication tokens, grant themselves persistent access, and compromise downstream Outlook mailboxes, SharePoint repositories, and OneDrive storage drives.
To defend modern enterprise infrastructure, security operations teams must understand the step-by-step technical progression of an ARToken intrusion campaign. The threat operates through an orchestrated sequence of execution phases designed to bypass standard perimeter controls.
The business consequences of an ARToken compromise are severe, spanning identity theft, cloud data exfiltration, and targeted Business Email Compromise. Once inside, the operators utilize integrated automation features to monitor compromised mailboxes simultaneously for sensitive keywords such as payment, invoice, and wire. This allows them to execute highly convincing financial redirect fraud.
Furthermore, the threat actors gain the ability to manipulate Outlook inbox rules, establishing silent forwarding paths or automatically deleting incoming security notifications to suppress evidence of intrusion. Beyond email, attackers can navigate, download, modify, or upload files within SharePoint Online and OneDrive databases, leading to massive data exposure, regulatory compliance penalties under frameworks like SOC 2 or PCI-DSS, and operational disruption.
Immediate Token Revocation: Because the adversary utilizes persistent Primary Refresh Tokens that survive password resets, standard password changes will not stop the intrusion. Responders must immediately execute explicit session revokation via PowerShell:
Revoke-MgUserSignInSession -UserId Victim-UPN-or-IDRestrict Device Code Flow: Disable the Device Authorization Grant flow in Microsoft Entra ID unless strictly required. If it must be maintained, utilize Conditional Access Policies to restrict its use to trusted, managed devices or specific network boundaries.
Log Analysis: Monitor Entra ID sign-in logs specifically for the Device Code authentication protocol and alert on successful authorizations originating from anomalous geographic locations, ASN blocks, or unmanaged IP pools.
Inbox Rule Audits: Regularly scan user mailbox configurations for newly created Transport Rules or Inbox Rules that forward or delete incoming messages.
To protect your organization from persistent identity threats and advanced phishing campaigns, proactive evaluation is essential. Securing your perimeter requires rigorous testing of application authentication layers and continuous visibility into leaked corporate assets. Organizations can partner with FemtoSec to run expert-led Penetration Testing to identify active vulnerabilities, or establish continuous Dark Web Monitoring to detect compromised credentials before they are weaponized on underground markets.
Free exposure check
Dark Web Scanner
check dark web mentions, compromised account indicators, malware log signals, public breach exposure, and recent underground market activity for your domain.
Threat actors begin their operations by validating target corporate accounts up to ten to fifteen days before executing the primary phishing phase. This ensures that only active, high-value corporate personas are targeted, reducing noise and detection risk. Additionally, the operators leverage advanced generative AI models to translate captured mailbox data and draft hyper-personalized phishing lures. These communications are customized specifically to the target's business functions, such as procurement, accounts payable, or executive operations.
To bypass strict secure email gateway controls, the attackers impersonate active vendors. While security frameworks such as SPF, DKIM, and DMARC may flag anomalies, the platform quietly pivots the reply-to address paths away from the spoofed vendor. The phishing emails contain minor, randomized mutations (including unique hex strings and signature graphics like pumber.png) to neutralize static file signatures. Crucially, the phishing links utilize anchor text pointing to a legitimate supplier's SharePoint domain, but the actual hyperlink redirects the user to a rogue SharePoint tenant controlled by the adversary inside an independent Microsoft 365 workspace. This allows the attacker to inherit the trusted reputation of Microsoft's root domain.
Upon clicking the malicious link, the victim is directed to a landing page hosted via Cloudflare Workers. Before initiating any phishing action, the platform executes a rigorous, multi-layered anti-analysis routine to screen out security crawlers, sandboxes, and defensive researchers. This defense evasion relies on seven distinct steps:
Layer 1 (User-Agent Filtering): A regular expression script scans incoming requests to block headless browsers, web scrapers, and automated command-line utilities.
Layer 2 (Automation Detection): The script validates the browser's navigator.webdriver property to identify automated execution frameworks.
Layer 3 (Feature Fingerprinting): The environment is checked for the presence of standard browser APIs, looking for the absence of window.chrome, navigator.vendor, or specific pointing device APIs.
Layer 4 (Window Dimension Analysis): The system catches automated sandboxes by identifying default headless viewport sizes that report dimensions of 0x0.
Layer 5 (Interaction Telemetry): The core payload remains locked until the system registers at least three mouse movements or one touch interaction from a real user.
Layer 6 (Timing Gate): The system enforces a mandatory delay, requiring at least 800 milliseconds to elapse from page load before payload activation.
Layer 7 (Movement Trajectory Validation): The script analyzes coordinates to verify organic, non-linear mouse paths, blocking automated, perfectly straight linear movements.
Once all seven layers are successfully validated, the client-side JavaScript payload (which is XOR-encrypted with a 16-byte key) is decrypted dynamically in memory.
The decrypted script extracts the victim's email address from the URL parameters (using the ?hint= parameter) and initiates a POST request to the C2 endpoint (/api/device/start) containing a hardcoded operator UUID. The platform then generates a legitimate Microsoft device login code and presents it to the victim alongside a 15-minute countdown clock. The user is instructed to navigate to microsoft.com/devicelogin to enter the code. Because the authentication takes place entirely on Microsoft's official infrastructure, any corporate multi-factor authentication prompt is fully validated by the victim. Once authorized, Microsoft's authorization servers issue access, refresh, and Primary Refresh Tokens directly to the attacker client ID, completely bypassing traditional endpoint controls.
With initial access established, the threat actor utilizes the ARToken administrative panel to execute backend commands, transitioning from basic access tokens to a permanent Primary Refresh Token. The platform leverages endpoints such as /prt/setup, /prt/refresh, and /prt/cookie to cement long-term persistence. This specialized session state is designed to survive subsequent password resets, ensuring the adversary maintains continuous access to the victim's tenant.