ARToken platform uncovered — an affiliate of the EvilTokens phishing service

Researchers have uncovered a new phishing-as-a-service (PhaaS) platform called “ARToken.” According to available data, it operates as an affiliate service of the larger phishing platform EvilTokens.

The discovery of ARToken has given security specialists the chance to take a detailed look at the workings of a toolkit aimed at compromising Microsoft 365 accounts.

What is known

The EvilTokens platform, of whose ecosystem ARToken is a part, specializes in phishing attacks targeting Microsoft 365 users. The emergence of the affiliated ARToken service indicates that the platform's operators are developing an affiliate model for distributing their tools — a hallmark of modern PhaaS platforms.

The published material does not provide details about the specific technical mechanisms, the scale of distribution, or the number of affected organizations.

Context

Phishing-as-a-service platforms allow attackers without deep technical skills to gain access to ready-made tools for running phishing campaigns, including templates for fake login pages, infrastructure for harvesting credentials, and bypassing multi-factor authentication mechanisms. In recent years, such services have become one of the key drivers behind the growing number of attacks on corporate cloud accounts, in particular on the Microsoft 365 ecosystem.

Detecting affiliated structures like ARToken helps security researchers track the evolution of the underground market for phishing services and warn organizations in a timely manner about new threats aimed at Microsoft cloud services.

Source: Bleeping Computer