ARToken & EvilTokens: The AI-Augmented Device Code Phishing PhaaS Hijacking Microsoft 365 and Automating BEC Fraud

Executive Summary ARToken is a Phishing-as-a-Service (PhaaS) operator panel published by Cisco Talos on July 1, 2026, which Talos assesses to be an affiliate panel of the EvilTokens platform — the Pha