Inside an affiliate panel targeting Microsoft 365

Reported 01 Jul 2026 by otx · Severity: medium

Cisco Talos discovered ARToken, a sophisticated phishing-as-a-service panel sharing infrastructure and operational patterns with the EvilTokens platform. The panel exposes over 80 API endpoints enabling device code phishing, Primary Refresh Token persistence, email access, busine