ARToken PhaaS C2 Infrastructure: Live Threat Actor Investigation Report

01

Examining the Suspicious Phishing Page — Extracting C2 References

cyberhawk@kali:~$ curl -s "https://50a201fd-dd2d-cf72-5fa6-adobe2.reynoldsjace5.workers.dev" \ | grep -oP '(https?://[^\s"'"'"']+pamconj[^\s"'"'"']*)' | sort -u https://spx.pamconj.com/api/device/start # Code generation — TA side, victim never sees this https://spx.pamconj.com/api/device/poll # Polls every 5s until victim authorises at login.microsoft.com/device https://spx.pamconj.com/api/session/status # Operator session tracking https://spx.pamconj.com/api/device/notify # Telegram alert on successful capture cyberhawk@kali:~$ curl -s "https://50a201fd-dd2d-cf72-5fa6-adobe2.reynoldsjace5.workers.dev" \ | grep -oP '[a-z0-9\-]+\.pamconj\.com' | sort -u spx.pamconj.com dashboard-bl.pamconj.com pamconj.com

Hunt Trigger: A pre-seeded device code on a phishing page is the signature of the device code phishing flow (T1566). The TA generates the code server-side via GET /api/device/start, injects it into the victim-facing page, then polls /api/device/poll until the victim enters it at login.microsoft.com/device — silently authorising the TA's OAuth session without the victim ever leaving what looks like a legitimate Adobe portal.

Full IOC Footprint — Compiled Through Investigation

cyberhawk@kali:~$ mkdir -p /home/cyberhawk/intel/artoken-eviltokens-2026-07/captures cyberhawk@kali:~$ cat /home/cyberhawk/intel/artoken-eviltokens-2026-07/iocs.txt # === DOMAINS (C2 / Phishing Infrastructure) === spx.pamconj.com # Primary C2 panel pamconj.com # Parent domain dashboard-bl.pamconj.com # Secondary dashboard clear90489058903-document.workers.dev # CF Worker phishing page reynoldsjace5.workers.dev # CF Worker phishing page 50a201fd-dd2d-cf72-5fa6-adobe2.reynoldsjace5.workers.dev # CF Worker sub-route

• 6 domains/subdomains identified across 2 infrastructure tiers (direct hosting + Cloudflare Workers)
• All probing conducted from isolated Kali Linux lab (10.100.110.2) — no production systems involved
• Investigation scope: DNS, TLS, HTTP, WHOIS, API surface, JS bundle extraction — passive/semi-passive only
• Evidence directory: /home/cyberhawk/intel/artoken-eviltokens-2026-07/

01

DNS Resolution Results

cyberhawk@kali:~$ for d in pamconj.com spx.pamconj.com dashboard-bl.pamconj.com; do echo "=== $d ==="; host $d 2>/dev/null; echo "" done === pamconj.com === pamconj.com has address 159.65.36.134 === spx.pamconj.com === spx.pamconj.com has address 159.65.36.134 === dashboard-bl.pamconj.com === dashboard-bl.pamconj.com has address 134.199.198.129

Cloudflare Worker DNS Resolution

cyberhawk@kali:~$ for d in clear90489058903-document.workers.dev reynoldsjace5.workers.dev \ 50a201fd-dd2d-cf72-5fa6-adobe2.reynoldsjace5.workers.dev; do echo "=== $d ==="; host $d 2>/dev/null; echo "" done === clear90489058903-document.workers.dev === Host clear90489058903-document.workers.dev not found: 3(NXDOMAIN) === reynoldsjace5.workers.dev === Host reynoldsjace5.workers.dev not found: 3(NXDOMAIN) === 50a201fd-dd2d-cf72-5fa6-adobe2.reynoldsjace5.workers.dev === 50a201fd-...reynoldsjace5.workers.dev has address 104.21.89.75 # Cloudflare IP

• Primary C2 (spx.pamconj.com) resolves and is actively serving content
• Two DigitalOcean IPs identified across two US regions (NJ + GA)
• Parent CF Worker accounts deleted — TA may have abandoned or rotated phishing infrastructure
• One sub-worker still resolves but Cloudflare blocks it with "Suspected Phishing" interstitial

01

Certificate Extraction

cyberhawk@kali:~$ echo | openssl s_client -connect spx.pamconj.com:443 \ -servername spx.pamconj.com 2>/dev/null | openssl x509 -noout -text Certificate: Data: Version: 3 (0x2) Serial Number: 05:d8:14:09:06:86:f8:9f:4b:f4:fb:6a:e9:1e:b6:95:32:e9 Signature Algorithm: ecdsa-with-SHA384 Issuer: C=US, O=Let's Encrypt, CN=E7 Validity Not Before: May 6 21:47:46 2026 GMT Not After : Aug 4 21:47:45 2026 GMT Subject: CN=spx.pamconj.com Subject Public Key Info: Public Key Algorithm: id-ecPublicKey Public-Key: (256 bit) ASN1 OID: prime256v1 NIST CURVE: P-256 X509v3 extensions: X509v3 Subject Alternative Name: DNS:spx.pamconj.com CT Precertificate SCTs: Timestamp : May 6 22:46:16.341 2026 GMT

Active maintenance confirmed: The Let's Encrypt cert was issued May 6, 2026 and the domain was registered April 6, 2026 — exactly 30 days apart. The TA set up infrastructure in April, obtained TLS in May, and the server content was last modified July 6, 2026 (1 day before this investigation). This is actively maintained infrastructure.

01

Header Capture — spx.pamconj.com

cyberhawk@kali:~$ curl -sI https://spx.pamconj.com/ HTTP/2 200 accept-ranges: bytes alt-svc: h3=":443"; ma=2592000 cache-control: public, max-age=0 content-type: text/html; charset=UTF-8 date: Tue, 07 Jul 2026 10:43:40 GMT etag: W/"4dd-19f362e70a8" last-modified: Mon, 06 Jul 2026 06:47:21 GMT via: 1.1 Caddy x-powered-by: Express content-length: 1245

Header Capture — /api/health

cyberhawk@kali:~$ curl -sI https://spx.pamconj.com/api/health HTTP/2 200 content-type: application/json; charset=utf-8 via: 1.1 Caddy x-powered-by: Express content-length: 50

OPSEC failure: The Express x-powered-by header is still enabled. Combined with the Caddy via header, the entire technology stack is exposed without any request. Production security hardening was not applied. This suggests developer-operator overlap — the TA is likely a developer running their own infrastructure, not a mature crime-as-a-service operation with dedicated devops.

01

WHOIS Query

cyberhawk@kali:~$ whois pamconj.com Domain Name: PAMCONJ.COM Registry Domain ID: 3085158178_DOMAIN_COM-VRSN Registrar: Hetzner Online GmbH Registrar IANA ID: 828 Created: 2026-04-06T19:14:14Z Expires: 2027-04-06T19:14:14Z Registrant Country: FR Name Server: ALIZA.NS.CLOUDFLARE.COM Name Server: MICAH.NS.CLOUDFLARE.COM DNSSEC: unsigned Registrant Email: [email protected] # WHOIS privacy service

02

IP Geolocation

cyberhawk@kali:~$ curl -s https://ipinfo.io/159.65.36.134/json { "ip": "159.65.36.134", "city": "Clifton", "region": "New Jersey", "country": "US", "org": "AS14061 DigitalOcean, LLC" } cyberhawk@kali:~$ curl -s https://ipinfo.io/134.199.198.129/json { "ip": "134.199.198.129", "city": "Douglasville", "region": "Georgia", "country": "US", "org": "AS14061 DigitalOcean, LLC" }

• French-registered domain, German registrar (Hetzner), US-hosted infrastructure (DigitalOcean)
• Multi-region DigitalOcean deployment suggests geographic redundancy planning
• Cloudflare used for DNS + Workers (phishing page distribution) — CF has partially taken action
• WHOIS privacy service (domain-contact.org) obscures registrant identity

01

Health Endpoint

cyberhawk@kali:~$ curl -s https://spx.pamconj.com/api/health {"ok":true,"timestamp":"2026-07-07T10:45:41.036Z"}

Authentication Probe

cyberhawk@kali:~$ curl -s https://spx.pamconj.com/api/auth/me {"error":"Authentication required"} cyberhawk@kali:~$ curl -s -X POST https://spx.pamconj.com/api/auth/login \ -H "Content-Type: application/json" -d '{}' {"error":"Username and password are required"} cyberhawk@kali:~$ curl -s https://spx.pamconj.com/api/tokens/ {"error":"Authentication required"}

• JWT Bearer token authentication — Authorization: Bearer <token> header required
• Login requires username + password (POST /api/auth/login)
• 2FA (TOTP) supported via /auth/2fa/setup, /auth/2fa/verify, /auth/2fa/disable
• Error messages are verbose — leak implementation details (Express default error handler)

02

LIVE PHISHING INFRASTRUCTURE CONFIRMED: The /api/device/start endpoint generates real Microsoft device codes without any authentication. This endpoint is the core phishing mechanism — it creates device codes that victims are social-engineered into entering at microsoft.com/device.

Device Code Generation (No Auth Required)

cyberhawk@kali:~$ curl -s -X POST https://spx.pamconj.com/api/device/start \ -H "Content-Type: application/json" -d '{}' { "device_code": "FBgABIQEAAAAdDD7nC9b5Q7JPd_okEQRFRXZvU3RzQXJ0aWZhY3RzA QAAAAAASAx3HaCh1E6QUvs2Qa61DMLkZApP0_VDySnDMO_LmybdhkJe11hk3u CiEMkJz2nMD86p5TeTag75U-s1iMUBBxsw7IoRJS5K9uhu...", "user_code": "FPKZ5QYBS", "verification_uri": "https://login.microsoft.com/device", "message": "To sign in, use a web browser to open the page https://login.microsoft.com/device and enter the code FPKZ5QYBS to authenticate.", "expires_in": "900", "interval": "5" }

• The C2 is actively generating Microsoft device codes — real, valid codes that work at login.microsoft.com/device
• No authentication required to trigger code generation — the endpoint is publicly accessible
• 15-minute expiry (900 seconds) with 5-second polling interval — standard Microsoft device code flow parameters
• The device_code JWT is issued by Microsoft's token service — the TA has a valid Azure AD application registration
• This confirms the platform is being used for active phishing campaigns as of July 7, 2026

01

Asset Capture

cyberhawk@kali:~$ curl -s https://spx.pamconj.com/ > captures/spx_panel_index.html cyberhawk@kali:~$ curl -s https://spx.pamconj.com/assets/index-BrN7SnMX.js > captures/spx_panel_bundle.js cyberhawk@kali:~$ curl -s https://spx.pamconj.com/assets/index-CjxfdApj.css > captures/spx_panel_styles.css cyberhawk@kali:~$ ls -lh captures/ 1.3K spx_panel_index.html 1.7M spx_panel_bundle.js 96K spx_panel_styles.css

React Route Extraction

cyberhawk@kali:~$ grep -oP 'path:\s*["`]/[^"`]*["`]' captures/spx_panel_bundle.js | sort -u path:`/` # Dashboard path:`/admin` # Admin panel path:`/blacklist` # Anti-analysis IP/path blacklist path:`/box-monitor` # Cross-account inbox keyword monitor path:`/expired` # Expired token management path:`/login` # Operator authentication path:`/settings` # Platform configuration path:`/shared/:shareKey` # Multi-operator shared access path:`/templates` # Phishing lure templates path:`/tokens` # Stolen token management path:`/tokens/:tokenId/entra` # Entra ID recon per victim path:`/tokens/:tokenId/outlook` # Email access per victim path:`/tokens/:tokenId/sender` # BEC email sender per victim path:`/tokens/:tokenId/sharepoint` # SharePoint access per victim

Hardcoded GUID

cyberhawk@kali:~$ grep -oP '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}' \ captures/spx_panel_bundle.js | sort -u 62e90394-69f5-4237-9190-012177145e10 # Azure AD Global Administrator role template ID

The hardcoded GUID 62e90394-69f5-4237-9190-012177145e10 is the well-known Microsoft Entra ID Global Administrator role template ID. This confirms the panel specifically checks whether stolen tokens belong to Global Admins — the highest-value target for complete tenant takeover.

01

Authentication & Operators

Token Management

Entra ID Weaponization

PRT & Cookie Theft

BEC, Inbox Rules, SharePoint & Data Extraction

Platform Configuration

01

ARToken Full Attack Kill Chain — from device code phishing to BEC and data exfiltration

01

Firewall / DNS Block Rules

# DNS sinkhole (BIND / Pi-hole / Cloudflare Gateway) spx.pamconj.com # Primary C2 pamconj.com # Parent domain dashboard-bl.pamconj.com # Secondary *.pamconj.com # Wildcard — catch future subdomains # IP blocklist 159.65.36.134 # C2 server 134.199.198.129 # Secondary server # Microsoft Sentinel / KQL — Device code phishing detection SigninLogs | where AuthenticationProtocol == "deviceCode" | where IPAddress in ("159.65.36.134", "134.199.198.129") | project TimeGenerated, UserPrincipalName, IPAddress, DeviceDetail, LocationDetails

01

Device Code Phishing — Anomalous Sign-Ins

// Detect device code authentication from suspicious IPs or unusual geolocations SigninLogs | where TimeGenerated > ago(7d) | where AuthenticationProtocol == "deviceCode" | extend City = tostring(LocationDetails.city), Country = tostring(LocationDetails.countryOrRegion) | summarize Count = count(), Accounts = make_set(UserPrincipalName) by IPAddress, City, Country | where Count > 3 | sort by Count desc

Inbox Rule Creation (Evidence Suppression)

// Detect inbox rules that delete or move messages — common evidence suppression OfficeActivity | where TimeGenerated > ago(7d) | where Operation in ("New-InboxRule", "Set-InboxRule", "UpdateInboxRules") | extend RuleParams = tostring(Parameters) | where RuleParams has_any ("DeleteMessage", "MoveToFolder", "Junk", "SoftDelete", "MarkAsRead") | project TimeGenerated, UserId, Operation, RuleParams, ClientIP

Anomalous App Consent / Credential Injection (T1098.001)

// Detect new credentials added to OAuth apps — potential T1098.001 backdoor AuditLogs | where TimeGenerated > ago(7d) | where OperationName in ("Add service principal credentials", "Update application - Certificates and secrets management") | extend InitiatedBy = tostring(InitiatedBy.user.userPrincipalName), TargetApp = tostring(TargetResources[0].displayName) | project TimeGenerated, InitiatedBy, OperationName, TargetApp

02