Cisco Talos’ research on ARToken builds on what’s known about the related EvilTokens phishing-as-a-service.

The remote access trojan was being used by a Chinese collective operating since 2014.

The malware-laced files include draft versions of diplomatic statements, correspondence letters, internal administrative notes and other documents.