Catan and Mouse
Summary: Cisco Talos highlighted research into ARToken, a phishing-as-a-service operator panel that shares infrastructure, API contracts, and operational patterns with the EvilTokens platform documented by Sekoia and Microsoft in early 2026. The panel exposes more than 80 API endpoints for device code phishing, Primary Refresh Token persistence, email access, business email compromise operations, and SharePoint exfiltration through a React-based dashboard.
What's compelling: Talos assesses ARToken as more mature than a simple device code phishing kit - a complete BEC operations environment whose capabilities are available to any operator who buys in.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026