ARToken: The Device Code Phishing Platform Built for Full Microsoft 365 Takeover

Most phishing works by tricking someone into typing a password on a fake page. ARToken doesn't bother.

ARToken is a Microsoft 365 account takeover phishing-as-a-service (PhaaS) platform, first observed in July 2026. It abuses the Microsoft OAuth 2.0 device-authorization grant—the technique Microsoft tracks as Storm-2372—to steal access and refresh tokens.

ARToken never shows a fake login and never proxies the session. It only asks the target to approve a sign-in on Microsoft's genuine device login page (login.microsoft[.]com/device)—using their real credentials and MFA. Because the sign-in is legitimate, it bypasses controls designed to catch credential phishing pages and remains effective even when MFA is enabled.

This tool is far more than just a token harvester. Its operator panel provides an integrated post-compromise console for harvesting and using stolen tokens, establishing device-registered persistence, and proxying Microsoft Graph requests against compromised accounts. From the same interface, operators can escalate privileges within an Entra tenant and monitor inboxes for business email compromise opportunities.

Each of those capabilities maps to a stage of the attack—and it begins with a lure.

Author’s Note: This report is based on Abnormal's analysis of ARToken's captured operator software and its reverse-engineered backend API. The operator panel images throughout are faithful reconstructions rendered with synthetic data. They reproduce ARToken's real interface exactly, but show no genuine target information. No authentication was performed against any operator system or Microsoft service.

The Kill Chain: From Lure to Token Theft

ARToken's affiliates—the operators who license it—all work from the same playbook. The lure's only job is to present a live Microsoft device code (user_code) and convince the recipient to enter it at the real Microsoft page.

1. The operator sends an invoice follow-up lure from a compromised legitimate Google Workspace or Microsoft 365 mailbox—e.g., "I'm following up regarding the invoice below…"

2. The message links to an anonymous SharePoint file share hosted on a compromised third-party tenant. The share contains a small Windows Internet Shortcut file.

3. Opening that file leads to a Cloudflare Workers "docviewer" page that displays a shared-document or identity-verification prompt behind anti-bot and visitor-fingerprinting controls.

4. ARToken's backend mints a live Microsoft device grant and displays the device code.

5. The target authorizes at login.microsoft[.]com/device. The backend polls Microsoft and captures the resulting access and refresh tokens into the operator's token store.

Capture is where the kill chain ends, and the platform takes over. From the panel, the operator can operate, persist, escalate, monitor, and monetize—each detailed below.

A Commercial-Grade Platform for Affiliates

ARToken operates as a multi-affiliate service. A central developer provides the panel and backend, while individual affiliates deploy the platform through their own infrastructure and Cloudflare accounts. We observed two affiliates running an identical panel build—as indicated by a matching stylesheet fingerprint—against separate backends and campaign identifiers.

That commercial structure is visible inside the product itself. An /admin view manages the operator team via /api/users, where accounts carry a role (e.g., affiliate) and a paid subscription with an expiry date. Per-operator accounts, roles, and subscription expiry controls indicate that ARToken is licensed to paying affiliates rather than maintained as a private tool for a single actor.

The console reinforces that impression, presenting an interface that would not look out of place in a legitimate SaaS product. Each session begins with a login screen supporting optional TOTP two-factor authentication. A dashboard tracks capture trends, active token counts, and the status of Cloudflare deployment, Telegram connectivity, and two-factor authentication—alongside a real-time activity feed of new captures and inbox keyword matches.

How Operators Build Lures

ARToken guides affiliates through the attack lifecycle, beginning with the creation and deployment of the lure. Rather than handcrafting phishing pages, the operator picks a theme from a built-in library, personalizes it, selects the capture mode and associated level of access, and pushes it live to Cloudflare Workers—all from the panel.

The bundle includes eleven built-in lure themes across five categories, each keyed by an internal ID. Every theme presents a familiar document-sharing or verification surface with a Microsoft sign-in overlay, and each ships with a default filename that the operator can override to match the pretext—e.g., invoice, shared document, request for proposal (RFP), voicemail notice.

An optional Turnstile verification test can gate each lure, filtering out crawlers and sandboxes before the device code is ever shown. The operator also sets a custom filename and arbitrary variables merged into the page—e.g., recipient name, company, invoice number. Thus, each delivery reads as tailored to its target.

Capture Mode: "Office" vs "Authenticator Broker"

The most consequential choice on the template screen is the capture mode (the bundle's clientMode). The setting determines which Microsoft client the harvested token is bound to. Because the operator chooses it when building the lure, the level of access the platform attempts to establish is set before the recipient clicks.

ARToken offers two capture modes. The default, office, is described in the panel as "Standard token capture—works with O365 device-code flows" and grants the operator a conventional Office/Graph access and refresh token: read/send mail, files, and contacts. The alternative, broker (Authenticator Broker), is described as "PRT-enabled—persists across password changes." It binds capture to the Microsoft Authenticator broker client, meaning the backend can register a device and mint a Primary Refresh Token—durable access that survives the target's password reset.

Selecting broker reveals an extra enforceMfa toggle. For defenders, the key point is that PRT persistence is selected during lure creation rather than added after the initial compromise. An operator who selects Broker mode signals intent to establish long-lived, device-registered access from the initial token capture.

Setting Up the Attack Infrastructure

With the lure built, the operator stands up the infrastructure that serves the lure, relays the device code, and exfiltrates captured data—all without leaving the panel. The settings screen exposes much of the platform’s operational model. Several controls map directly to techniques intended to complicate analysis, automate deployment, or conceal attacker activity.

Deploying Lures on Cloudflare Workers

ARToken uses Cloudflare Workers to host its delivery pages because the *.workers[.]dev domain can inherit the reputation of a widely used legitimate service. The panel deploys and tears down "docviewer" pages on demand using the affiliate's own Cloudflare credentials configured in settings.

Defenders should focus on the individual Cloudflare account or worker hostname rather than the shared workers[.]dev domain. The specific delivery accounts appear in the IOC table below.

Cloaking Lures From Researchers

A blocklist of IP addresses, network ranges, and autonomous system numbers (ASNs) allows the operator to conceal the lure from researchers and automated scanners. Visitors from listed networks are silently redirected to the configured defaultRedirect destination, rather than seeing the device code flow. As a result, an analyst may encounter a page that appears inactive or benign even when the lure remains operational for intended targets.

Device Code Relay: How ARToken Steals Microsoft Tokens

The trick that makes device code phishing effective is that nothing about it looks like phishing. The target-facing "docviewer" Worker has one job: get the target to enter a live Microsoft device code at Microsoft's real page. Behind the verification test and IP fingerprint gate, the page communicates with two unauthenticated backend endpoints that broker a genuine Microsoft device grant.

ARToken's backend requests the grant, shows the resulting user_code to the recipient via the lure, and then polls Microsoft until the target completes authorization—at which point it captures the returned tokens.

The relayed grant is a genuine, unmodified Microsoft device code. It is issued by a Microsoft first-party public client against Microsoft Graph, and the target only ever interacts with Microsoft’s own device page on Microsoft’s real domain. There is no lookalike URL to notice, no fake login to fingerprint, and no adversary-in-the-middle proxy in the path.

The target completes MFA directly with Microsoft, and the attacker receives the resulting authorized session. MFA therefore succeeds as designed while still authorizing the attacker’s session.

What Operators Do With Stolen Tokens

ARToken converts captured tokens into immediately usable account access. From the token menu, an operator can launch post-compromise actions without exporting the token or moving to a separate tool. With one click, the operator is inside the target’s account.

Managing and Prioritizing Captured Tokens

Every captured token is listed with the target’s identity and tenant, along with the OAuth permissions it carries. The panel also displays capture metadata, including the source IP address and geolocation, as well as the token’s health and active or expired status.

Operators can search, tag, group, bulk export, and back up the whole collection. The detail that matters most to a defender is the permission scope: a token that can read and send mail is damaging; a token scoped for directory or role management is a foothold on the entire tenant. By surfacing scope up front and letting operators tag and group accounts, the panel effectively triages compromised identities for monetization.

The panel even scores each token's durability—raising the score when a Broker mode PRT or a Windows Hello key is live. The resulting score allows the operator to identify at a glance which stolen identities remain usable.

Operating Through the Microsoft Graph Proxy

Rather than hand tokens off to an external tool, ARToken proxies arbitrary Microsoft Graph calls through its own backend using the stolen token. It then renders the target's mailbox directly inside the panel.

ARToken also centralizes compromised accounts within a single interface, allowing the affiliate to manage a larger set of targets through the same workflow. An operator can even hand a captured account to a collaborator through a share link, without exposing the raw token.

Persisting With a Primary Refresh Token (PRT)

A stolen access token typically expires after roughly an hour, making a one-time device code capture of limited value on its own. ARToken closes that gap by using the captured token to register a device and mint a Primary Refresh Token. The platform then issues the matching x-ms-RefreshTokenCredential authentication cookie.

Together, these artifacts provide durable access that can outlast the original token and resemble that of a legitimately enrolled device. The operator may therefore be able to return days later without repeating the initial phishing flow.

Escalating to Full Entra Tenant Takeover

When a captured token has sufficient privileges, the operator can use ARToken to expand the compromise beyond a single account to the broader tenant. The platform enumerates users and provides controls to reset passwords, enable or disable accounts, create users, and modify directory role membership.

By adding an attacker-controlled account to a directory role, the operator can grant that account Global Administrator privileges. A single overpermissioned account may therefore enable a threat actor to turn one stolen token into a tenant-wide compromise.

Monitoring and Monetizing the Inbox

A background job scans the mailboxes of captured accounts for operator-defined terms, such as “payment,” “wire,” and “invoice.” Matching messages appear in the Box Monitor interface, while unread counts are sent to the dashboard and Telegram.

This turns inbox surveillance into a lead generation mechanism for business email compromise. Rather than manually searching every mailbox, the operator can wait for a legitimate payment conversation to appear and then hijack the thread. By enabling the threat actor to reply from the compromised account within the existing conversation and inherit the trust associated with both, this feature connects the initial token theft directly to payment fraud.

The same console then weaponizes that access. ARTSender sends mail from the compromised account through a proxy to blend in with legitimate activity. A contact extractor harvests the target's correspondence for the next wave, and a workflow rules engine creates mailbox rules that hide replies and forward finance threads.

What Defenders Need to Know

ARToken’s design is oriented toward business email compromise, with its features revealing the intended targets. Invoice-themed lures and finance-related inbox monitor keywords indicate a focus on finance and accounts payable personnel.

The Entra takeover surface suggests overprivileged administrators are also high-value targets, as a token with directory management permissions can enable tenant-wide compromise. The campaigns, first observed in July 2026, targeted US recipients via invoice-themed SharePoint lures.

Because the target authenticates legitimately at Microsoft, the usual signals—e.g., lookalike domains, fake login pages, failed MFA—never fire. Detection should instead focus on the authentication pattern and ARToken-specific platform fingerprints. Additionally, incident response should assume that the attacker may have established durable, device-registered access.

Hunt and Detect

• Device code sign-ins. Alert on interactive sign-ins using the Device Code authentication protocol in Entra sign-in logs. Prioritize sign-ins involving finance, accounts payable, or administrative users, particularly when they originate from residential or otherwise unexpected IP addresses. Because ARToken can route traffic through a residential proxy, geolocation and IP reputation alone are insufficient.

• Device registration shortly after sign-in. A new Entra device registration or Primary Refresh Token issuance shortly after a device code sign-in may indicate that the Broker mode persistence step is in progress.

• BEC follow-on. Look for new inbox rules that hide replies, redirect messages, or forward finance-related threads. Also investigate unusual Microsoft Graph access to mail, contacts, or files from a recently registered device, particularly when followed by outbound messages from the compromised account. These behaviors align with ARToken’capabilities: s Box Monitor, Graph proxy, workflow rules engine, and ARTSendes.

• Directory changes. Password resets, enabling or disabling accounts, and directory-role membership changes from a recently compromised account map to the Entra takeover surface.

Technical Note: The wrapped device code contains a Base64 substring that decodes to EvoStsArtifacts—Microsoft's own Evolved-STS device-code format, not an ARToken artifact. It should not be used as a detection signal.

Respond and Remediate

• Block, but don't over-block. Block the specific malicious share URLs, worker hostnames/accounts, and operator backends listed in the Indicators of Compromise (IOCs)—not the compromised parent organizations, which are victims.

• Evict durable access. Revoke the compromised user’s active sessions and refresh tokens, and remove any persistence mechanisms ARToken may have established. Delete attacker-registered devices and associated Windows Hello credentials, remove any unauthorized MFA or other authentication methods, and reset the user’s password before restoring access.

• Audit the tenant. Review directory-role changes, newly created users, and mailbox rules created during the exposure window.

Device Code Phishing Is Now a Product

ARToken shows that device code phishing has evolved into a packaged account takeover service. Its significance lies in its integrated workflow—not in any one capability viewed alone. That integration is also what makes it hard to catch. There's no malicious domain to block and no failed login to flag because the target authenticates legitimately with Microsoft.

Defenders should assume that traditional phishing and MFA controls will not stop this technique, and shift attention to what device code abuse actually leaves behind: anomalous device code sign-ins, subsequent device registrations, and the account changes that follow.

When lure creation, token theft, persistence, and monetization ship as a single subscription product, the barrier to running a sophisticated account takeover campaign drops to the cost of a license.

For additional insight into the attack landscape, visit Abnormal Intelligence, our threat intelligence data and research hub.

Indicators of Compromise (IOCs)