Listen to the episode
TLDR
ARToken / EvilTokens: device code phishing against Microsoft 365 Security researchers at Cisco Talos uncovered ARToken , a phishing as a service platform linked to the EvilTokens toolkit, that abuses Microsoft's legitimate device code...
How it works
ARToken / EvilTokens: device code phishing against Microsoft 365 Security researchers at Cisco Talos uncovered ARToken , a phishing as a service platform linked to the EvilTokens toolkit, that abuses Microsoft's legitimate device code...
Red flags
- Any unsolicited message asking you to enter a device code on microsoft.com/devicelogin — Microsoft never asks for codes out of the blue. Urgency or impersonation (IT support, boss, vendor) pushing you to act quickly without verifying in person or by a known channel. Unexpected MFA prompts, new inbox rules, unfamiliar sign ins, or
What to do
- 1Red flags Any unsolicited message asking you to enter a device code on microsoft.com/devicelogin — Microsoft never asks for codes out of the blue.
- 2Urgency or impersonation (IT support, boss, vendor) pushing you to act quickly without verifying in person or by a known channel.
Source
bleepingcomputer
Source reviewed by Mythos Forensic Team
https://www.bleepingcomputer.com/news/security/artoken-phaas-exposes-eviltokens-microsoft-365-phishing-toolkit/FAQ
Is Device code phishing kits like ARToken and EvilTokens target Microsoft 365 users to bypass MFA a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Any unsolicited message asking you to enter a device code on microsoft.com/devicelogin — Microsoft never asks for codes out of the blue. Urgency or impersonation (IT support, boss, vendor) pushing you to act quickly without verifying in person or by a known channel. Unexpected MFA prompts, new inbox rules, unfamiliar sign ins, or
What should I do first?
Red flags Any unsolicited message asking you to enter a device code on microsoft.com/devicelogin — Microsoft never asks for codes out of the blue.; Urgency or impersonation (IT support, boss, vendor) pushing you to act quickly without verifying in person or by a known channel.
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.