ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit

Cisco Talos researchers discovered ARToken, a React-based phishing-as-a-service platform operating as an affiliate of the EvilTokens ecosystem. The kit enables attackers to steal Microsoft 365 authentication tokens and establish persistent access using Primary Refresh Tokens across Outlook mailboxes, SharePoint sites, and OneDrive files via Cloudflare Workers.