Martin Lee: Running through the Arctic (and the threat landscape)

This Cisco Talos RSS batch highlights multiple security research posts and tooling updates. Key items: Talos uncovered “ARToken,” an EvilTokens affiliate phishing-as-a-service panel targeting Microsoft 365 that exposes 80+ API endpoints enabling device-code phishing, Primary Refresh Token (PRT) persistence, mailbox access and BEC operations, and SharePoint exfiltration. Talos also disclosed four heap-based buffer overflows in MediaArea’s MediaInfoLib, a DICOM heap-overflow case study affecting DICOM/Pydicom/GDCM/Orthanc parsing, and the June 2026 Microsoft Patch Tuesday summary (including Snor