Full Report
Kali365 is turning a legitimate Microsoft login into a gateway to corporate data. The phishing kit targets US organizations with attacker-controlled device codes that victims approve on Microsoft's real authentication page. Once access and refresh tokens are issued, attackers may retain access to email, documents, and cloud resources, creating a direct path to data exposure, financial fraud,
Analysis Summary
# Tool/Technique: Kali365
## Overview
Kali365 is a sophisticated phishing kit designed to exploit Microsoft's legitimate device code authentication flow (OAuth 2.0 Device Authorization Grant). Unlike traditional phishing that steals credentials, Kali365 tricks users into authorizing an attacker-controlled device code on Microsoft's official login portal. This bypasses many standard security controls, as the victim authenticates on a genuine Microsoft domain, eventually granting the attacker persistent access via OAuth tokens.
## Technical Details
- **Type:** Phishing Kit / Adversary-in-the-Middle (AiTM) Variant
- **Platform:** Microsoft 365 / Azure AD (Cloud Environments)
- **Capabilities:** Device code manipulation, OAuth token theft (Access & Refresh tokens), session persistence, bypass of MFA (Multi-Factor Authentication).
- **First Seen:** Approximately August 2026 (per article reporting)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1528 - Steal Application Access Token]
- **[TA0003 - Persistence]**
- [T1136.003 - Create Account: Cloud Account] (via session persistence)
- **[TA0005 - Defense Evasion]**
- [T1550.001 - Use Alternate Authentication Material: Application Access Token]
## Functionality
### Core Capabilities
- **Device Code Phishing:** Generates a legitimate Microsoft device code request and presents it to the victim.
- **Lure Impersonation:** Crafts high-fidelity fake landing pages for services like SharePoint, OneDrive, and DocuSign.
- **Official Domain Abuse:** Forces the victim to enter the code at `microsoft[.]com/devicelogin`, making the process appear legitimate to both the user and automated URL scanners.
- **Token Harvesting:** Automatically captures OAuth access and refresh tokens once the victim completes the authentication process.
### Advanced Features
- **MFA Bypass:** Because the user completes the MFA challenge themselves on the real Microsoft portal, the resulting token is already "MFA-satisfied."
- **Persistent Access:** By obtaining refresh tokens, attackers can maintain access to the environment even if the user changes their password, until the specific session/token is revoked.
## Indicators of Compromise
- **File Hashes:** N/A (Web-based kit)
- **File Names:** SharePoint-themed lures, OneDrive-themed lures.
- **Registry Keys:** N/A
- **Network Indicators:**
- `microsoft[.]com/devicelogin` (Legitimate site used in the flow)
- `app[.]any[.]run/tasks/d078f430-c3cc-44e8-a809-5506205049c3` (Analysis link)
- **Behavioral Indicators:**
- Users navigating to the Microsoft device login page from unusual referral links (SharePoint/DocuSign lures).
- Rapid generation of OAuth tokens for "Cross-Platform Command Line Interface" or similar generic Azure applications from unusual IP ranges.
## Associated Threat Actors
- Unknown/Generic (Widely available kit used against US-based corporate targets).
## Detection Methods
- **Behavioral Detection:** Monitor for "Sign-in to the Microsoft Command Line Interface" or unexpected application authorizations in Entra ID (Azure AD) logs.
- **Conditional Access Logs:** Watch for successful logins where the "Device Code Flow" is used by standard end-users (this flow is typically intended for IoT devices or headless servers).
- **Phishing Intelligence:** Utilize STIX/TAXII feeds to ingest rotating domains used for the initial "lure" stage.
## Mitigation Strategies
- **Hardening Recommendations:** Disable the Device Code Flow in Microsoft 365/Azure AD for users who do not require it.
- **Conditional Access:** Implement policies that require Compliant or Hybrid Joined devices, which can block tokens harvested from unauthorized attacker devices.
- **User Awareness:** Educate employees that legitimate SharePoint or DocuSign requests will never ask them to go to a separate page to "enter a code" manually.
## Related Tools/Techniques
- **Evilginx2 / Muraena:** Standard AiTM proxy tools.
- **OAuth App Consent Phishing:** A similar technique involving malicious third-party apps rather than device codes.
- **Device Code Flow Abuse:** A general technique used by various red teams and threat actors to bypass MFA.