Full Report
Huntress traced device code phishing from Tencent Cloud to Kali365, a Microsoft 365 kit that steals tokens and keeps access even after MFA or password resets.
Analysis Summary
# Tool/Technique: Kali365 (aka Octopi365 / Freedom365)
## Overview
Kali365 is a sophisticated Phishing-as-a-Service (PhaaS) platform specializing in Microsoft 365 token theft. It primarily utilizes **Device Code Phishing** to bypass Multi-Factor Authentication (MFA). Unlike traditional phishing kits that only steal credentials, Kali365 provides a comprehensive ecosystem for maintaining persistence, triaging stolen data, and automating Business Email Compromise (BEC) fraud.
## Technical Details
- **Type:** Phishing-as-a-Service (PhaaS) / Adversary-in-the-Middle (AiTM) kit.
- **Platform:** Microsoft 365 (M365) / Azure AD.
- **Capabilities:** Token theft, MFA bypass, automated BEC drafting, mailbox triaging, and persistence.
- **First Seen:** May 2026 (Active campaigns identified May 18–27, 2026).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1528 - Steal or Forge Authentication Tokens]
- [T1557 - Adversary-in-the-Middle]
- **[TA0003 - Persistence]**
- [T1098 - Account Manipulation]
- **[TA0007 - Discovery]**
- [T1114.002 - Email Collection: Remote Email Services]
## Functionality
### Core Capabilities
- **Device Code Phishing:** Exploits the legitimate Microsoft device authorization flow (`microsoft[.]com/devicelogin`), prompting users to enter a code that grants the attacker a refresh token.
- **Token Management:** Captures and manages session tokens, allowing operators to maintain access even if the user changes their password.
- **PhaaS Ecosystem:** Features a central management panel with Role-Based Access Control (RBAC), billing systems, and a domain marketplace.
- **Lure Templates:** Includes over 33 built-in phishing templates designed to mimic corporate services.
### Advanced Features
- **AI-Assisted BEC:** Built-in tools for drafting convincing fraud emails and triaging "high-value" targets within a compromised inbox.
- **OctoLink Live/Sender:** Companion desktop applications that convert stolen tokens into active browser sessions and facilitate mass outbound phishing from the compromised account.
- **Exchange Admin Abuse:** Capabilities to manipulate administrative settings to ensure long-term persistence and visibility.
## Indicators of Compromise
- **File Names:** `OctoLink Live`, `OctoLink Sender`.
- **Network Indicators:**
- IP addresses originating from Tencent Cloud (AS132203).
- Over 240 IPs identified hosting various panel variants.
- Infrastructure often utilizes `[.]vip`, `[.]top`, or `[.]shop` TLDs for phishing panels.
- **Behavioral Indicators:**
- Successful `UserLoggedIn` events from unusual Geolocation/ISP (specifically Tencent Cloud).
- Authentication using the **Microsoft Authentication Broker** Client ID (`29d9ed98-a469-4536-ade2-f981bc1d605e`) followed by unusual mailbox activity.
- Sudden influx of device code authentication requests across multiple users.
## Associated Threat Actors
- **Storm-2372:** (Overlapping tactics observed in Microsoft intelligence reporting).
- **Kali365/Octopi365 Operators:** A PhaaS group likely operating out of the cybercrime underground, frequently rebranding their kit.
## Detection Methods
- **Behavioral Detection:** Monitor Azure AD/Entra ID Sign-in logs for "Device Code" authentication types, especially when originating from unexpected IP ranges (Tencent, DigitalOcean, etc.).
- **Log Analysis:** Audit logs for the creation of new inbox rules or the use of "Microsoft Authentication Broker" from non-compliant devices.
- **User Agent Analysis:** Look for automated or "headless" browser signatures used by the kit's backend to scrape mailboxes.
## Mitigation Strategies
- **Disable Device Code Flow:** If not required for business operations, disable the Device Code authentication flow via Entra ID (Azure AD) conditional access policies.
- **Conditional Access:** Enforce "Compliant Device" or "Managed Device" requirements for all sign-ins to prevent stolen tokens from being used on attacker-controlled machines.
- **FIDO2 Security Keys:** Transition to phishing-resistant MFA (FIDO2) which prevents AiTM and device code interception.
- **Token Revocation:** If a compromise is suspected, administrators must revoke all active refresh tokens for the user.
## Related Tools/Techniques
- **EvilTokens:** A similar PhaaS platform using device code phishing.
- **Knight Office:** An AiTM phishing kit focusing on Cloudflare bypass and token theft.
- **Storm-2372:** Actor group known for utilizing similar infrastructure and flows.