ARToken Exposes EvilTokens' Microsoft 365 Phishing Kit

Michael Miller · 2026-07-03

A new phishing-as-a-service (PhaaS) platform called "ARToken" has surfaced, and it looks like it's working as an affiliate of the bigger EvilTokens phishing platform. For researchers, this is a rare chance to peek inside a toolkit that's specifically built to take down Microsoft 365 accounts. And trust me, it's not pretty. ### What Is ARToken and Why Should You Care? ARToken isn't just another phishing tool. It's a full-service package that makes it easy for even low-skill attackers to launch campaigns. Think of it like a subscription service for cybercrime. You pay a fee, and you get access to ready-made phishing pages, credential stealers, and session hijackers. - **Low barrier to entry:** Anyone can sign up and start phishing in minutes. - **Targeted attacks:** The toolkit focuses on Microsoft 365, which is used by millions of businesses in the United States. - **Affiliate model:** ARToken shares profits with EvilTokens, meaning the threat is growing fast. ### How Does the Microsoft 365 Phishing Toolkit Work? The toolkit works by tricking users into handing over their login credentials. It creates fake login pages that look exactly like the real Microsoft 365 sign-in screen. Once you type in your username and password, the attacker captures it in real time. But it doesn't stop there. The toolkit can also steal session cookies. That means even if you have multi-factor authentication (MFA) enabled, the attacker can bypass it by using your active session. Scary, right? > "The biggest threat isn't the phishing email itself, but how easily these tools let attackers steal session tokens and bypass MFA." — Michael Miller, Lead Antidetect Browser Strategist ### Why This Matters for U.S. Professionals If you're working in cybersecurity or managing IT for a company, this is a wake-up call. Microsoft 365 is the backbone of countless businesses across the United States. A successful attack can lead to data breaches, financial losses, and reputational damage. Here are some real-world impacts: - **Data theft:** Attackers can access emails, files, and confidential documents. - **Financial fraud:** They can impersonate executives to authorize wire transfers. - **Ransomware:** Once inside, they can deploy ransomware and demand payment in Bitcoin. ### How to Protect Yourself and Your Organization You don't need to be a security expert to defend against these attacks. Here are a few practical steps: 1. **Enable MFA everywhere.** But remember, session hijacking can still happen, so use hardware tokens or authenticator apps. 2. **Train your team.** Teach employees to spot phishing emails. Look for typos, suspicious links, and unexpected requests. 3. **Use antidetect browsers.** These tools can help you spot fake login pages by analyzing browser fingerprints. 4. **Monitor login activity.** Set up alerts for unusual sign-ins, especially from new locations or devices. ### The Bottom Line ARToken and similar platforms are making phishing easier and more dangerous. But by staying informed and using the right tools, you can reduce the risk. Keep your defenses updated, educate your people, and always question unexpected emails. If you want to dive deeper into how antidetect browsers can help, stay tuned for more posts. We're just scratching the surface here.