As cited
Copy frozen at (site build).
threat intel
This phishing kit looks more like BEC-as-a-service
Cisco Talos discovered ARToken, an operator panel that functions as a business email compromise-as-a-service platform affiliated with the EvilTokens phishing-as-a-service operation. ARToken includes advanced capabilities beyond typical phishing kits, such as inbox rule manipulation and shared access links, along with a seven-layer anti-analysis system for evasion. The platform targets specific organizations with customized lures that impersonate legitimate vendors, such as spoofed accounts-payable communications designed to trigger fraudulent payment requests.
Why it matters: ARToken represents a significant escalation in phishing sophistication, combining device code phishing with full BEC operations in a managed service, making it a high-priority threat for organizations handling financial transactions and vendor communications.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
This phishing kit looks more like BEC-as-a-service
Cisco Talos discovered ARToken, an operator panel that functions as a business email compromise-as-a-service platform affiliated with the EvilTokens phishing-as-a-service operation. ARToken includes advanced capabilities beyond typical phishing kits, such as inbox rule manipulation and shared access links, along with a seven-layer anti-analysis system for evasion. The platform targets specific organizations with customized lures that impersonate legitimate vendors, such as spoofed accounts-payable communications designed to trigger fraudulent payment requests.
Why it matters: ARToken represents a significant escalation in phishing sophistication, combining device code phishing with full BEC operations in a managed service, making it a high-priority threat for organizations handling financial transactions and vendor communications.
- Source published
- First seen by Cybersecurity Tracker