Researchers say a phishing service called ARToken is tied to the EvilTokens platform and is being used to break into Microsoft 365 accounts and steal long-lived access tokens. Cisco Talos found a React-based ARToken management panel with more than 80 API endpoints, including the same Microsoft OAuth 2.0 device-code phishing and Primary Refresh Token (PRT) workflows previously linked to EvilTokens. The toolkit can access Outlook, SharePoint, and OneDrive, create inbox rules, send mail from victim accounts, and deploy phishing infrastructure through Cloudflare Workers.
Eduard Kovacs
2026.09.23
95% relevant
This is a direct update on the EvilTokens operation: Microsoft says it disrupted the platform, seized 50 sites, disabled 150 domains, linked it to more than 12,000 compromised email accounts at over 10,000 organizations, and named two UK-arrested suspects. It adds concrete scale, takedown actions, and Microsoft’s description of EvilTokens’ AI-assisted device-code phishing and post-compromise targeting workflow.
info@thehackernews.com (The Hacker News)
2026.09.22
95% relevant
This appears to be a direct update on the EvilTokens operation, adding that Microsoft took down the service and tying it to about 12,000 compromised inboxes through device-code phishing against Microsoft 365 accounts.
2026.09.22
97% relevant
This is a direct update on the same EvilTokens operation, adding Microsoft's court-authorized takedown of 50 sites and 150 domains, cooperation with OpenAI and Health-ISAC, and the arrest in the UK of two alleged operators. It also adds scale and impact details, including links to more than 12,000 compromised inboxes across over 10,000 organizations.
Bill Toulas
2026.09.22
95% relevant
This is the same underlying EvilTokens phishing-service story and adds major new developments: Microsoft-led disruption of the infrastructure, U.K. arrests of two suspected administrators, and updated scope showing more than 12,000 compromised Microsoft accounts at over 10,000 organizations.
2026.09.22
94% relevant
This is a direct update on the EvilTokens phishing ecosystem: it adds that Microsoft and partners seized 50 EvilTokens sites, disabled 150 supporting domains, and UK police arrested two alleged administrators after the service was used to compromise 12,000 inboxes across 10,000 organizations.
Lawrence Abrams
2026.07.03
100% relevant
This article establishes a distinct tracked story by adding new technical reporting on ARToken as an apparent EvilTokens affiliate platform, with concrete details about its Microsoft 365 token theft, persistence, and BEC automation capabilities.