The EvilTokens phishing kit, which allows criminals to circumvent multi-factor authentication (MFA) and authenticate as victims within Microsoft 365 applications, has been found to possess even more alarming capabilities than previously understood. Cisco Talos, in a recent report, detailed how the phishing operation is more sophisticated and effective than earlier analyses suggested.
New Insights into Phishing Techniques
Talos researchers uncovered a phishing-as-a-service (PhaaS) platform named ARToken, which appears to be linked to EvilTokens. This platform shares infrastructure and operational patterns with EvilTokens, indicating a broader network of phishing operations. Michael Kelley, a security research engineer at Talos, emphasized that the phishing techniques employed are targeted rather than random, making detection more challenging.
How the Phishing Scheme Operates
The phishing messages utilize real vendor relationships to deceive victims. For instance, an email sent to a US life-sciences company purported to be from a legitimate plumbing contractor, claiming outstanding invoices. The email’s content and sender details were crafted to appear authentic, while the reply-to address redirected responses to an unrelated domain. This tactic significantly reduces the likelihood of the email being flagged as phishing.
Enhanced Capabilities of ARToken
During their investigation, Cisco Talos identified that ARToken not only mimics EvilTokens but also includes advanced anti-analysis features and a comprehensive post-exploitation toolkit. This toolkit allows attackers to manage tokens, maintain persistence, and conduct business email compromise (BEC) operations. These capabilities include reading victims’ Microsoft Outlook inboxes, sending emails as the victim, creating inbox rules, and monitoring keywords across compromised accounts.
Implications for Organizations
The findings suggest that EvilTokens has evolved into a complete BEC operations environment, posing significant risks to organizations using Microsoft 365. The scale of the attacks is notable, with Microsoft reporting that hundreds of organizations are compromised daily. The sophistication of the phishing techniques and the integration of advanced tools highlight the need for enhanced security measures to protect against such threats.
This article was produced by NeonPulse.today using human and AI-assisted editorial processes, based on publicly available information. Content may be edited for clarity and style.
