ARTOKENARToken

ARToken (also written ARTokens) is a Microsoft 365 account-takeover phishing-as-a-service panel abusing the OAuth 2.0 device authorization grant, first described by Cisco Talos in July 2026 as sharing infrastructure, API contracts and operational patterns with the EvilTokens platform. Lures impersonate vendor invoices aimed at accounts-payable staff and lead, via SharePoint shares on compromised or look-alike tenants and Windows Internet Shortcut files, to Cloudflare Workers pages showing the device code, so the victim completes MFA on the genuine Microsoft sign-in page while the backend captures access and refresh tokens. A 'broker' mode obtains Primary Refresh Tokens that persist across password changes. Its 80+ API endpoints cover mailbox reading and sending, inbox rules, keyword monitoring for BEC, SharePoint/OneDrive access, device registration and Entra ID takeover. Abnormal AI describes a multi-affiliate model in which a central developer licenses the panel and backend to paying affiliates. In October 2026 ZeroBEC reported an updated panel (build 5.1.2-prod) used in two disrupted campaigns with RFP and payment-invoice lures chaining a compromised SharePoint tenant, a .URL file, Google Sites and Cloudflare Workers, with headless-browser detection, operator-configurable polling aliases replacing the documented endpoints, and optional Workers-hosted polling. No developer or threat actor is named.