UAT-7810 continues building ORB networks using new malware

Cisco Talos reports multiple noteworthy threats and research items. Key operational threats: UAT-7810 continues developing custom malware to build ORB networks, indicating ongoing active development and deployment of networked malware. ARToken, an EvilTokens affiliate phishing-as-a-service panel targeting Microsoft 365, exposes 80+ API endpoints enabling device-code phishing, Primary Refresh Token (PRT) persistence, email access, BEC operations, and SharePoint data exfiltration — a high-risk capability for account takeover and data theft. Additional Talos coverage includes COM abuse by Windows