{
  "Event": {
    "analysis": "1",
    "date": "2026-07-01",
    "extends_uuid": "",
    "info": "[Threat Intel] Inside an affiliate panel targeting Microsoft 365",
    "protected": false,
    "publish_timestamp": "1783858395",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1783858395",
    "uuid": "ad0e5747-deef-4b3e-a96e-aa38fe205a99",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#7c6ad9",
        "local": false,
        "name": "misp-galaxy:producer=\"Cisco Talos Intelligence Group\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c1d2e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#4a5d84",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Services - T1583.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#08221e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Application Access Token - T1528\"",
        "relationship_type": ""
      },
      {
        "colour": "#7ffc24",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Additional Cloud Credentials - T1098.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Account Access Removal - T1531\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#23cf0e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Email Collection - T1114.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#5300bd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Application Access Token - T1550.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#10003f",
        "local": false,
        "name": "rectifyq:sub-category=\"tool-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"cloudflare\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"microsoft\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782990013",
        "to_ids": false,
        "type": "link",
        "uuid": "0f2c0203-2e34-4bfc-a446-e350fa413fbe",
        "value": "https://blog.talosintelligence.com/artoken-inside-an-eviltokens-affiliate-panel-targeting-microsoft-365/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782990013",
        "to_ids": false,
        "type": "text",
        "uuid": "6446336d-d13a-4b41-b9fe-c419ee99b793",
        "value": "Cisco Talos discovered ARToken, a sophisticated phishing-as-a-service panel sharing infrastructure and operational patterns with the EvilTokens platform. The panel exposes over 80 API endpoints enabling device code phishing, Primary Refresh Token persistence, email access, business email compromise operations, and SharePoint exfiltration through a React-based dashboard. The platform deploys a seven-layer anti-analysis system combining client-side behavioral verification with XOR-encrypted payloads. ARToken abuses Microsoft's OAuth 2.0 Device Authorization Grant to bypass multi-factor authentication entirely. Analysis reveals post-compromise capabilities including token management across password resets, automated BEC operations, inbox rule manipulation for evidence suppression, cross-account keyword monitoring, and SharePoint file operations. The platform operates as multi-tenant infrastructure with subscription-based affiliate access, representing a complete operations environment rather than simple phish..."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782990013",
        "to_ids": false,
        "type": "text",
        "uuid": "147444e4-b1a5-4fc9-ba0f-63aec8d42378",
        "value": "Name: Inside an affiliate panel targeting Microsoft 365\nAuthor: AlienVault\nAdversary: \nTags: [\"oauth abuse\", \"phishing-as-a-service\", \"eviltokens\", \"business email compromise\", \"microsoft 365\", \"artoken\", \"device code phishing\", \"primary refresh token\"]\nTgtd countries: []\nMlwr families: [\"ARToken\", \"EvilTokens\"]\nAttack_ids: [\"T1213.002\", \"T1539\", \"T1497.001\", \"T1566.002\", \"T1119\", \"T1090\", \"T1102\", \"T1583.006\", \"T1528\", \"T1098.001\", \"T1566\", \"T1531\", \"T1027\", \"T1114.002\", \"T1567.002\", \"T1562.008\", \"T1213\", \"T1071.001\", \"T1550.001\", \"T1078.004\"]\nIndustries: [\"Finance\", \"Healthcare\"]"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782990013",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "9ecc91ba-84dd-4210-aae3-3c7c8af6fff2",
        "value": "CVE-2025-20333"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782990013",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "b4b47ee5-25bf-41ed-b068-da78ab7cd8ab",
        "value": "CVE-2025-20362"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782990013",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "bf1d979a-48b2-4dff-8317-0e52f8c67a67",
        "value": "CVE-2026-20182"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847889",
        "to_ids": true,
        "type": "hostname",
        "uuid": "9abdcc08-bb49-48bb-896b-6a40477d462c",
        "value": "dashboard-bl.pamconj.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847910",
        "to_ids": true,
        "type": "hostname",
        "uuid": "edd6c58e-63d2-433d-afa0-e4d5904696ad",
        "value": "spx.pamconj.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847933",
        "to_ids": true,
        "type": "domain",
        "uuid": "9cefb7f7-0fd0-474f-a783-167507ed18c9",
        "value": "pamconj.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847954",
        "to_ids": true,
        "type": "hostname",
        "uuid": "700cd20f-9577-4444-a5a1-04260c6cf856",
        "value": "clear90489058903-document.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847975",
        "to_ids": true,
        "type": "hostname",
        "uuid": "95d59106-df59-4a34-a26e-c024becb99c2",
        "value": "917bedb0-554e-a8b9-79f1-docviewer.clear90489058903-document.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847996",
        "to_ids": true,
        "type": "hostname",
        "uuid": "6d26280b-3674-4e5f-9e05-0b5f4c7cf3e5",
        "value": "321a1392-939d-3bf5-4040-docviewer.clear90489058903-document.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783848017",
        "to_ids": true,
        "type": "hostname",
        "uuid": "faf0144c-423a-4821-9b90-229bfcffa770",
        "value": "98c4c82e-2d81-0837-e3d6-docviewer.clear90489058903-document.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783848038",
        "to_ids": true,
        "type": "hostname",
        "uuid": "a7ce5b64-6288-486f-b506-74a0fca7fb90",
        "value": "112838d8-9a75-2e90-d63b-docviewer.clear90489058903-document.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783848059",
        "to_ids": true,
        "type": "hostname",
        "uuid": "0f236ed1-0373-4a40-a625-023ddde83b11",
        "value": "aquaclaude-09494-9099403-docviewer.clear90489058903-document.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783848080",
        "to_ids": true,
        "type": "hostname",
        "uuid": "af8d76c9-7669-4a03-8f2a-42c5fd838368",
        "value": "e5469cec-124a-c84f-abaa-docviewer.clear90489058903-document.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783848101",
        "to_ids": true,
        "type": "hostname",
        "uuid": "c39da2b7-400e-4b6b-8c59-c800f4b83d9b",
        "value": "50a201fd-dd2d-cf72-5fa6-onedrive.clear90489058903-document.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783848123",
        "to_ids": true,
        "type": "hostname",
        "uuid": "657597bf-072a-4396-b245-a5d32071480e",
        "value": "reynoldsjace5.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783848144",
        "to_ids": true,
        "type": "hostname",
        "uuid": "a6df86ce-e201-4729-8213-86086727627f",
        "value": "50a201fd-dd2d-cf72-5fa6-adobe2.reynoldsjace5.workers.dev",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783848165",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "bfc83017-db3c-46bc-85a3-de55b45d6309",
        "value": "172.67.214.35",
        "Tag": [
          {
            "colour": "#c4bd10",
            "local": false,
            "name": "asn:asn=\"13335\"",
            "relationship_type": ""
          },
          {
            "colour": "#60003e",
            "local": false,
            "name": "asn:as-owner=\"CLOUDFLARENET\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#2c2142",
            "local": false,
            "name": "false-positive:risk=\"high\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}