ARToken: Inside an Evil Tokens affiliate panel targeting Microsoft 365
Summary: Cisco Talos recovered two near-identical phishing emails sent roughly four minutes apart on April 20, 2026, spoofing an accounts-payable contact at a legitimate Wisconsin contractor and pointing to a look-alike SharePoint tenant hosted on a genuine sharepoint.com domain. Talos also identified an "ARToken Panel" management dashboard at dashboard-bl.pamconj[.]com, whose 1.7MB React JavaScript bundle exposed routes and API endpoints without any credentials, tied to EvilTokens by overlapping technical indicators.
What you should know: The lure works because the destination is a real sharepoint.com host, so it inherits SharePoint's clean reputation, and the panel advertises "PRT-enabled - Persists across password changes" - meaning a single device-code approval can outlast the password reset your incident response relies on.
Read the original at Cisco Talos ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026