Evil Is as Evil Does: New EvilTokens Affiliate Panel Uncovered

Security researchers from Cisco Talos have detailed the emergence of ARToken, a recently deployed phishing-as-a-Service (PhaaS) platform designed specifically to exploit Microsoft 365 environments. 

This new operator panel has a clear lineage going back to the EvilTokens framework, which emerged in early 2026 and has the ability to bypass MFA by manipulating the OAuth 2.0 Device Authorization Grant. These types of kits show the continued maturation of adversary infrastructure, shifting from rudimentary phishing kits to fully integrated operational environments. Researchers at Sekoia dug into the EvilTokens platform a few months ago and exposed the framework’s comprehensive functionality and its business model, which starts at an affordable one-time fee of $1,500.

At its core, ARToken leverages a React-based management dashboard that exposes more than 80 distinct API endpoints. This architecture allows threat actors to orchestrate highly controlled attacks, managing everything from initial device code phishing lures to the final exfiltration of sensitive data. Technical analysis shows that the platform shares critical operational patterns with its predecessor, including identical API contracts and Primary Refresh Token (PRT) management lifecycles, ensuring seamless integration for attackers accustomed to the EvilTokens ecosystem.

The Talos team discovered the ARToken set up during an incident response.

“During investigation of phishing infrastructure targeting a Talos IR engagement, we identified a management panel at “dashboard-bl.pamconj[.]com” serving a React single-page application (SPA) with a 1.7MB compiled JavaScript bundle. The page title reads ‘ARToken Panel’,” the Talos analysis says.

“SPA architecture exposes all client-side code including routes, UI labels, component logic, and API endpoint paths in the JavaScript bundle regardless of authentication state. No credentials were required or bypassed.”

Attackers utilizing the ARToken platform employ targeted vendor-impersonation strategies, specifically crafting lures centered on outstanding invoices to direct victims toward malicious, look-alike SharePoint URLs. To maintain operational security against automated scanners and security analysts, the kit uses a seven-layer dip of anti-analysis defense systems. This layer relies on XOR-encrypted payloads and client-side behavioral verification, making it significantly harder for traditional signature-based detection mechanisms to identify and mitigate the threat.

To maintain operational security against automated scanners and security analysts, the kit uses a seven-layer dip of anti-analysis defense systems.

“This client-side behavioral verification is notably more sophisticated than the server-side X-Antibot-Token mechanism (SHA-256 of secret + timestamp + "antibot" with 5-minute validity window) documented in Sekoia's EvilTokensresearch. The divergence is consistent with EvilTokens' known practice of selling anti-bot pages as a separate product through a dedicated Telegram bot. Affiliates may deploy upgraded or custom anti-analysis modules independently of the core platform,” the researchers said.

Once a compromise is established, the platform provides affiliates with a suite of post-exploitation capabilities that extend well beyond initial entry. These include the ability to refresh captured tokens and escalate access to Primary Refresh Tokens for persistent, long-term unauthorized access. Beyond mere access, the platform facilitates automated Business Email Compromise (BEC) operations, allowing operators to monitor inboxes, manipulate email rules to suppress evidence of the intrusion, and conduct full-scale exploration and data exfiltration from the victim’s SharePoint and OneDrive environments.

The Talos researchers also highlighted the inclusion of advanced features not previously documented in EvilTokens, such as cross-account keyword monitoring and the implementation of geo-dynamic templates. These additions transform ARToken into a highly adaptable environment, demonstrating that the operators behind these kits are treating their malware platforms as sophisticated software-as-a-service products designed for scalability and persistent access rather than simple, opportunistic credential harvesting.