Finance/AP-Themed Phishing Lure for Device Code Flow (ARToken)

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•0

Detects phishing emails leveraging finance or accounts-payable themes (e.g., invoices, payment confirmations, bank detail updates) that contain known ARToken phishing template strings. This activity is indicative of credential harvesting via device code authorization flow abuse.