Kali365 PhaaS — Telegram-Distributed Microsoft 365 Device-Code Phishing with OAuth Token Theft & MFA Bypass (FBI PSA I-052126-PSA)
Kali365 PhaaS (TL-2026-0560), also tracked as Kali365, is a high-severity phishing campaign, first published 2026-05-22. It is attributed to Kali365 PhaaS operators with medium confidence, affects Microsoft Microsoft 365 / Entra ID (Azure AD) tenants, maps to 38 MITRE ATT&CK techniques (T1069.003, T1071.001, T1078.004), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-0560
- Threat ID
- TL-2026-0560
- Also known as
- Kali365, K365, Kali 365 PhaaS, FBI PSA I-052126-PSA
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-05-22
- Last reviewed
- 2026-05-22
- Attribution
- Kali365 PhaaS operators
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- healthcare, financial-services, legal, managed-service-providers, government, education, technology, manufacturing
- Target regions
- North America, Europe, Australia, United Kingdom
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Kali365 PhaaS
Malware and tooling: EvilTokens, Kali365 PhaaS panel
Kali365 is a Phishing-as-a-Service (PhaaS) platform, first observed in April 2026 and warned about by FBI PSA I-052126-PSA on 2026-05-21, that abuses Microsoft's legitimate OAuth 2.0 device authorization grant flow (RFC 8628) to steal access and refresh tokens against Microsoft 365 tenants, bypassing MFA without ever collecting passwords. The service is sold and operated through Telegram channels and provides AI-generated lure templates, automated campaign deployment, real-time victim dashboards, and post-consent OAuth token capture that yields persistent access to Outlook, Teams, OneDrive and SharePoint.
How Kali365 PhaaS works
Kali365 is a turnkey Phishing-as-a-Service (PhaaS) offering that surfaced in underground Telegram channels around April 2026 and was elevated to a FBI Public Service Announcement (I-052126-PSA) on 2026-05-21 after observed exploitation against U.S. enterprise Microsoft 365 tenants in healthcare, financial services, legal, and managed-services sectors. Unlike traditional adversary-in-the-middle (AiTM) kits such as Tycoon2FA or EvilProxy, Kali365 does not proxy victim credentials; instead it exploits the legitimate Microsoft identity platform device authorization grant (https://login.microsoftonline.com/{tenant}/oauth2/v2.0/devicecode), turning a sanctioned protocol into a no-credential-theft phishing primitive.
The operator workflow is automated end-to-end. From a Kali365 web panel (hosted on bullet-proof infrastructure behind Cloudflare and rotating .top / .shop / .cfd domains), the attacker selects an AI-generated lure (Teams meeting invite, IT helpdesk re-authentication notice, document share, vendor invoice). Kali365 backend calls the Microsoft OAuth devicecode endpoint with first-party client_ids commonly trusted in enterprises — most frequently 04b07795-8ddb-461a-bbee-02f9e1bf7b46 (Azure CLI), d3590ed6-52b3-4102-aeff-aad2292ab01c (Microsoft Office), 1950a258-227b-4e31-a9cf-717495945fc2 (Azure PowerShell), and 14d82eec-204b-4c2f-b7e8-296a70dab67e (Microsoft Graph PowerShell) — and requests scopes such as offline_access, openid, profile, Mail.ReadWrite, Files.ReadWrite.All, User.Read, Directory.Read.All, and Sites.Read.All. Microsoft returns a short-lived (~15 minute) user_code and a verification_uri (microsoft.com/devicelogin or microsoft.com/deviceauth). Kali365 then renders these inside an AI-tailored email body and dispatches the campaign via compromised SendGrid, Brevo and Mailgun accounts (and increasingly through trusted compromised tenants to gain inbox-placement reputation).
When the targeted user clicks the link, they land on the real Microsoft device login page — there is no fake page. The victim enters the attacker-supplied code, completes their normal MFA challenge (FIDO2, Microsoft Authenticator, TOTP, or text), and consents — at which point Microsoft issues the access_token and refresh_token to the attacker's polling backend. Because the user performed full MFA on Microsoft's real surface, the tenant Sign-in logs record a successful interactive sign-in with strongAuthentication = true, often from a residential-proxy IP geolocated near the victim. The refresh_token is long-lived (90 days rolling for most tenants without Conditional Access token-lifetime policies) and can be silently refreshed to maintain persistence.
With tokens in hand, Kali365 operators run automated post-exploitation playbooks: enumerate the mailbox via Graph /me/messages, harvest contacts and global address list, create hidden Outlook inbox rules to forward or delete messages matching keywords like 'invoice', 'wire', 'payroll', register a new Authenticator device through MySecurityInfo to seed long-term persistence even after a password reset, exfiltrate OneDrive and SharePoint documents via batched Graph requests, send internal BEC lures from the victim mailbox, and pivot to Teams chats. Higher-tier Kali365 subscribers receive a 'Tenant Recon' module that maps the directory through Graph /organization and /users to identify Global Administrators and conditional-access policies before targeting.
Kali365 is sold on a tiered subscription via Telegram bot @kali365_support_bot with 'Starter' ($300/week), 'Pro' ($1,200/month) and 'Enterprise' ($3,500/month) tiers that unlock concurrent campaigns, AI lure variants, residential proxy egress, and 24/7 operator chat. The platform shares operators and infrastructure overlap with the older EvilTokens kit referenced in adjacent reporting; Microsoft Threat Intelligence and Volexity have linked some Kali365 campaigns to financially-motivated cluster Storm-1755 and to opportunistic abuse by Russian-aligned APT29 / Midnight Blizzard, which has used device-code phishing in prior espionage operations (a TTP first publicly detailed by Volexity in August 2024).
Detection is hard because the entire authentication transaction is legitimate from Microsoft's perspective. The single high-fidelity signal is in Entra ID Sign-in logs: AuthenticationProtocol = 'deviceCode' for users who do not normally consume that protocol, combined with mismatched client/user-agent (e.g. Azure CLI client_id from a browser-class user-agent) and impossible geography between the user's prior sign-ins and the attacker's polling IP. Defenders should disable device code flow via Conditional Access (grantControls -> block deviceCode authentication protocol) for all users that do not require it, enforce token protection / continuous access evaluation, and hunt for anomalous offline_access refresh-token activity. Remediation when compromised requires revoking refresh tokens (Revoke-AzureADUserAllRefreshToken), removing rogue Authenticator devices, deleting attacker-created inbox rules, and rotating any service-principal credentials touched by the compromised user.
MITRE ATT&CK techniques used in TL-2026-0560
Discovery
T1069.003 Cloud Groups; T1087.003 Email Account; T1087.004 Cloud Account; T1526 Cloud Service Discovery
Command and Control
T1071.001 Web Protocols; T1102.002 Bidirectional Communication
Initial Access
T1078.004 Cloud Accounts; T1199 Trusted Relationship; T1566 Phishing; T1566.002 Spearphishing Link; T1566.003 Spearphishing via Service
Persistence
T1098.002 Additional Email Delegate Permissions; T1098.003 Additional Cloud Roles; T1098.005 Device Registration; T1137.005 Outlook Rules
Collection
T1114.002 Remote Email Collection; T1114.003 Email Forwarding Rule; T1213.002 Sharepoint; T1530 Data from Cloud Storage
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1606.002 SAML Tokens
Lateral Movement
Exfiltration
T1537 Transfer Data to Cloud Account; T1567.002 Exfiltration to Cloud Storage
lateral-movement
T1550.001 Application Access Token; T1550.004 Web Session Cookie
defense-impairment
T1556.006 Multi-Factor Authentication
Defense Evasion
Resource Development
T1583 Acquire Infrastructure; T1583.003 Virtual Private Server; T1583.006 Web Services; T1585.002 Email Accounts; T1586 Compromise Accounts; T1587.001 Malware; T1588.002 Tool; T1608.005 Link Target
Impact
Affected products and versions in Kali365 PhaaS
- Microsoft — Microsoft 365 / Entra ID (Azure AD) tenants
Vulnerable versions: all tenants without Conditional Access policy blocking device code flow
Fixed in: any tenant enforcing Conditional Access authenticationFlows: block deviceCode - Microsoft — Exchange Online
Vulnerable versions: all - Microsoft — OneDrive for Business
Vulnerable versions: all - Microsoft — SharePoint Online
Vulnerable versions: all - Microsoft — Microsoft Teams
Vulnerable versions: all - Microsoft — Microsoft Graph API
Vulnerable versions: v1.0; beta
Remediation for Kali365 PhaaS
Patches
- No software patch — this abuses a legitimate Microsoft identity feature (RFC 8628 device authorization grant). Mitigation is configuration via Conditional Access.
Immediate actions
- Disable Microsoft Entra ID device code authentication flow via Conditional Access policy (grantControls block authenticationFlows deviceCode) for all users who do not have a documented device-code use case
- Hunt Entra Sign-in logs for AuthenticationProtocol = ''deviceCode'' in the last 90 days; investigate any unexpected hits per user
- Revoke refresh tokens for any suspected victim: Revoke-MgUserSignInSession or Revoke-AzureADUserAllRefreshToken
- Remove all rogue MFA / Authenticator registrations from MySecurityInfo for the user; reset password and require sign-out from all devices
- Delete any inbox rules created by the attacker that forward, move-to-RSS-Feeds, or auto-delete messages matching financial keywords (invoice, wire, ACH, payroll)
- Block known Kali365 Cloudflare-fronted phishing domains (kali365[.]top, k365-portal[.]shop, ms365-reauth[.]cfd and related) at the email gateway and DNS
- Quarantine and forensically image any endpoint where a user has reported entering a device code from an unsolicited email
Workarounds
- If Conditional Access (Entra ID P1/P2) is not licensed, use Authentication Method Policy or PowerShell to disable device code grant per user where feasible
- Block outbound DNS to known Kali365 staging domains at egress for environments where Conditional Access is unavailable
- Force re-authentication every 4 hours for high-privilege accounts via session control
Longer-term hardening
- Enforce Conditional Access policy: block device code flow for all users by default; whitelist only specific device-enrollment service accounts and limit by named-location
- Enable Microsoft Entra Token Protection / Continuous Access Evaluation (CAE) so stolen tokens are invalidated when device or location signals change
- Reduce default refresh-token lifetime via token lifetime policies (e.g. 24h refresh-token validity for high-privilege roles)
- Migrate high-value users to phishing-resistant authentication (FIDO2 security keys, Windows Hello for Business, certificate-based authentication) — note: device-code phishing bypasses phishing-resistant MFA at the protocol level because user willingly authorizes a real Microsoft prompt, so combine with device-code block
- Deploy Microsoft Defender for Cloud Apps anomaly policies for ''Activity from infrequent country'', ''Impossible travel'', and ''Suspicious inbox manipulation rule''
- Operationalize alerting on first-party client_id usage anomalies (Azure CLI / Azure PowerShell / Microsoft Graph PowerShell from non-administrator users)
- User-awareness training specifically on device code phishing: ''never enter a code you did not initiate on microsoft.com/devicelogin''
- Subscribe to FBI IC3 PSA bulletins and Microsoft Threat Intelligence Center feeds for PhaaS infrastructure updates
Weaknesses (CWE) in Kali365 PhaaS
CWE-287, CWE-294, CWE-522, CWE-345, CWE-451, CWE-770
Timeline of Kali365 PhaaS
- RFC 8628 OAuth 2.0 Device Authorization Grant published — the legitimate protocol later abused by Kali365
- Volexity publishes detailed analysis of Russian SVR / APT29 abusing Microsoft device code flow against M365 accounts — first widely-reported nation-state use of the TTP
- Microsoft Threat Intelligence publishes report on Storm-2372 conducting device code phishing campaign targeting government, NGO, and IT services
- Kali365 PhaaS first advertised in Russian-language Telegram cybercrime channels at $300/week starter tier
- First public reports of M365 tenant compromises matching Kali365 TTPs (deviceCode auth from residential proxies) appear on r/sysadmin and Microsoft Tech Community
- Kali365 ''Pro'' tier adds AI-generated lure module producing per-target Teams meeting / IT helpdesk re-auth emails
- FBI Cyber Division opens investigation after MSP supply-chain incident traced to Kali365 device-code phishing affecting ~40 downstream tenants
- FBI issues Public Service Announcement I-052126-PSA warning of Kali365 PhaaS targeting Microsoft 365
- Threadlinqs Intelligence publishes TL-2026-0560 with full MITRE mapping, IOCs, and detection coverage
- Help Net Security and Cyber Security News publish coverage of FBI PSA; threat enters mainstream defender awareness
- As of 2026-05-29, Kali365 PhaaS remains live and escalating — still sold on Telegram with no takedown/arrests, per FBI IC3 PSA260521 (2026-05-21) and reporting from BleepingComputer, Infosecurity, Malwarebytes and Arctic Wolf. It abuses legitimate RFC 8628 device-code flow, so there is no patch; only Conditional Access config blocks it, and unconfigured tenants stay fully exposed.
Sources cited for Kali365 PhaaS
- FBI PSA Alert I-052126-PSA — Kali365 Phishing-as-a-Service
- Microsoft 365 users targeted by new phishing threat that bypasses MFA — Help Net Security
- FBI Warns of Kali365 Attacking Microsoft 365 Users to Steal Logins and Bypass MFA — Cyber Security News
- RFC 8628 — OAuth 2.0 Device Authorization Grant
- Microsoft identity platform and OAuth 2.0 device authorization grant flow
- Volexity — Russian SVR Targets Microsoft 365 Accounts via Device Code Phishing (Midnight Blizzard / APT29)
- Microsoft Threat Intelligence — Storm-2372 conducts device code phishing campaign
- Microsoft Entra ID Conditional Access — Block authentication flows (deviceCode)
- Mandiant — Phishing-as-a-Service evolution: AiTM, Token Theft, and Device Code Abuse
- MITRE ATT&CK T1528 — Steal Application Access Token
Threats related to Kali365 PhaaS
- Kali365 Phishing-as-a-Service Kit Abuses Microsoft Device Code Authentication to Hijack Microsoft 365 Accounts
- Device Code Phishing: OAuth Device Authorization Grant Abuse Bypasses All MFA Forms, Including Passkeys
- ARToken Phishing Panel Abuses Microsoft OAuth Device Code Flow to Hijack Microsoft 365 Accounts (EvilTokens PhaaS)
- Greatness PhaaS Platform Spoofs RingCentral in Adversary-in-the-Middle and Device Code Phishing Campaign Targeting Microsoft 365 Accounts
- EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device Code Authentication with AES-GCM "Ghost Code" to Breach Finance, Tech, and Managed Security Firms
Detection coverage for TL-2026-0560
As of 2026-05-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0560 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.