ARToken PhaaS Reveals EvilTokens' Microsoft 365 Phishing Toolkit

Michael Miller · 2026-07-03

A new phishing-as-a-service (PhaaS) platform called "ARToken" has surfaced, and it looks like it's working as an affiliate of the EvilTokens phishing platform. This gives cybersecurity researchers a rare, behind-the-scenes look at a toolkit built specifically to target Microsoft 365 users. If you're managing security for a business, this is something you need to know about. ### How ARToken and EvilTokens Work Together ARToken isn't a standalone threat. It's more like a franchise operation. The platform offers ready-made phishing kits that let attackers set up fake login pages for Microsoft 365 in minutes. These pages look almost identical to the real ones, so even careful users can get tricked. Once someone enters their credentials, the data goes straight to the attacker. - The kits are easy to use, even for people with little technical skill. - They include templates that mimic Microsoft 365's login interface. - The platform handles hosting and domain setup for affiliates. This model makes phishing more accessible, which is why it's spreading fast. ### What Makes This Toolkit Dangerous The ARToken platform includes features that bypass common security measures. For example, it can detect when a security researcher or automated scanner visits the phishing page and then redirects them to a harmless site. This keeps the real phishing page hidden from detection tools. Another trick is that the toolkit uses dynamic content. The fake login page adapts based on the victim's IP address and device. So, a user in the United States might see a slightly different page than someone in Europe. This makes the attack feel more personal and harder to spot. > "With ARToken, even low-skill attackers can launch sophisticated Microsoft 365 phishing campaigns that fool most users." ### Who's at Risk and What to Watch For If your company uses Microsoft 365, your employees are the primary target. The phishing emails often look like routine password reset requests or security alerts. They might reference a recent login from an unfamiliar location, which pushes people to click without thinking. Common warning signs include: - Emails with urgent language about account access. - Links that go to a domain that's slightly misspelled (like microsoft-verify.com). - Requests to enter credentials on a page that feels off. ### Protecting Your Team from These Threats Stopping these attacks requires a mix of technology and training. Start by enabling multi-factor authentication (MFA) on all Microsoft 365 accounts. Even if an attacker gets a password, MFA can block them. Also, use email filtering tools that flag suspicious links and attachments. But technology alone isn't enough. Run regular phishing simulations to teach your team how to spot fake login pages. Make it a habit to report any suspicious email immediately. The faster you know about a threat, the faster you can respond. ### The Bottom Line for Security Pros ARToken shows how phishing-as-a-service is evolving. Attackers are using more sophisticated tools to target specific platforms like Microsoft 365. As a security professional, stay updated on these threats and keep your defenses sharp. A little awareness can go a long way in preventing a costly breach.