OTX Threat: Inside an affiliate panel targeting Microsoft 365

Cisco Talos discovered ARToken, a sophisticated phishing-as-a-service panel sharing infrastructure and operational patterns with the EvilTokens platform. The panel exposes over 80 API endpoints enabling device code phishing, Primary Refresh Token persistence, email access, business email compromise operations, and SharePoint exfiltration through a React-based dashboard. The platform deploys a seve CVEs: CVE-2025-20333, CVE-2025-20362, CVE-2026-20182 Sectors: Finance, Healthcare