Researchers have identified ARToken, a phishing-as-a-service platform operating as an affiliate of the EvilTokens phishing operation. The discovery reveals an extensive toolkit designed specifically to compromise Microsoft 365 credentials.
ARToken operates within the growing ecosystem of phishing-as-a-service (PhaaS) platforms, which offer criminal infrastructure and tools to lower-skilled attackers. The platform functions as part of the EvilTokens operation, suggesting a hierarchical structure where different tools and services are compartmentalized.
The toolkit exposed by researchers includes capabilities specifically engineered for Microsoft 365 environments. This focus reflects the widespread adoption of Microsoft's cloud productivity suite across enterprises, making it a high-value target for credential theft operations.
PhaaS platforms typically operate on subscription or affiliate models, allowing operators to monetize their infrastructure by renting access to other cybercriminals. ARToken's relationship with EvilTokens indicates a mature operational structure where specialized components handle different attack phases.
Microsoft 365 represents a particularly attractive target because compromised credentials provide attackers with access to email, cloud storage, and integrated applications. Organizations relying on Microsoft 365 often serve as entry points for broader network compromise.
The discovery of ARToken adds to mounting evidence that phishing infrastructure continues to evolve. Rather than declining, phishing-as-a-service operations are becoming more specialized and compartmentalized, with different teams handling specific aspects of attack campaigns.
Organizations using Microsoft 365 should implement multi-factor authentication, monitor for unusual account activity, and conduct regular security awareness training. Email security solutions that detect phishing attempts before they reach users remain essential, particularly as attackers refine their toolkits to evade detection.
This exposure demonstrates the value of continued security research into underground platforms and criminal infrastructure. Understanding how these operations function helps defenders identify compromised accounts and trace attack chains before they escalate.
U.S. federal prosecutors have unsealed charges against three Russian nationals accused of operating a bulletproof hosting service that supported ransomware gangs responsible for over $62 million in damages worldwide.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that attackers are actively exploiting three vulnerabilities in Internet-exposed on-premises SharePoint Server instances. Organizations running affected versions must patch immediately.
Tailscale disclosed a critical vulnerability in its SSH implementation that allowed attackers to gain root access through insecure argument handling. The flaw has been patched in recent versions.
A new study found that social media platforms referred over 5.7 million visits to nonconsensual deepfake pornography sites between December 2025 and March 2026, with YouTube and X accounting for the majority of traffic.