EvilTokens' Microsoft 365 Phishing Kit Exposed by ARToken PhaaS

Robert Moore · 2026-07-03

A new phishing-as-a-service (PhaaS) platform called ARToken has popped up, and it's giving us a rare look inside a sophisticated toolkit aimed at taking over Microsoft 365 accounts. Think of it as an affiliate program for cybercriminals, tied to the infamous EvilTokens platform. This isn't just another scam—it's a full-blown operation designed to steal credentials and bypass security, all for a price. Security researchers dug into ARToken and found a treasure trove of tools. The platform offers ready-made phishing pages that mimic Microsoft 365 login screens, complete with 2FA bypass tricks. It's like buying a lockpick set online, but for email accounts. The whole thing runs on a subscription model, with prices starting at around $200 per month. That's a steal for attackers, but a nightmare for businesses. ### How ARToken Works ARToken operates like a franchise. Affiliates get access to a dashboard where they can customize phishing campaigns. You pick a target, choose a template, and the system generates fake login pages that look identical to the real thing. The platform even handles hosting and domain rotation to avoid detection. It's disturbingly easy. Here's a quick breakdown of what's included: - Pre-built phishing templates for Microsoft 365 and Outlook - Automatic session cookie harvesting to bypass 2FA - Real-time alerts when a victim enters credentials - Built-in proxy system to hide the attacker's location This is all automated. No coding skills needed. Just point, click, and steal. ### The Threat to Businesses For companies using Microsoft 365, this is a wake-up call. Traditional email filters might not catch these attacks because the phishing pages are hosted on legitimate-looking domains. Once an attacker gets in, they can read emails, reset passwords, and even move laterally within the network. The damage can run into hundreds of thousands of dollars in lost data and recovery costs. A single compromised account can lead to a full-blown breach. We're talking about stolen intellectual property, client lists, and financial records. And since ARToken uses affiliate networks, the attackers are hard to trace. They're like ghosts in the machine. ### What You Can Do to Stay Safe Don't panic. There are practical steps you can take to protect your organization. Start with these: - Enable multi-factor authentication (MFA) using an authenticator app, not SMS - Train employees to spot phishing emails—hover over links before clicking - Use conditional access policies in Microsoft 365 to block suspicious logins - Monitor for unusual login patterns, like access from new locations or devices These measures won't make you invincible, but they'll raise the bar. Most attackers move on when they hit resistance. ### Why This Matters Now The rise of PhaaS platforms like ARToken shows how cybercrime is becoming a service industry. It's no longer just lone hackers in basements. We're dealing with organized groups that sell tools to anyone with a credit card. The barrier to entry is lower than ever. For cybersecurity professionals, this means staying one step ahead. Keep your software updated, run regular phishing simulations, and never assume you're too small to be a target. Small businesses are actually prime targets because they often skimp on security. Remember, the goal isn't to be perfect. It's to be harder to attack than the next guy. ARToken and EvilTokens are out there, but with the right defenses, you can keep them out of your Microsoft 365 environment.