# Kali365/Octopi365 Device Code Phishing-as-a-Service Campaign

> Kali365 is a mature, multi-edition phishing-as-a-service (PhaaS) platform that exploits Microsoft's OAuth 2.0 device code authentication flow to steal persistent refresh tokens from Microsoft 365 accounts. The kit bypasses multi-factor authentication and survives password changes, enabling persistent compromise and post-exploitation business email compromise (BEC) attacks. Peak campaign activity on May 20, 2026 saw 80+ successful authentications; the FBI issued PSA I-052126-PSA on May 21 warning of hundreds of organizational compromises.

- **Published:** 2026-06-28T00:00:00Z
- **Last reviewed:** 2026-06-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0984
- **ID:** TL-2026-0984
- **Severity:** CRITICAL
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Kali365, also known as Octopi365 and Freedom365, emerged in April 2026 as a sophisticated phishing-as-a-service platform targeting Microsoft 365 environments globally. The kit exploits a fundamental weakness in Microsoft's device code authentication flow—an OAuth 2.0 mechanism originally intended for IoT and smart TV authentication. Threat actors dynamically generate legitimate device codes from Microsoft's OAuth service and redirect phishing victims to the genuine Microsoft login page (microsoft.com/devicelogin), where victims enter the intercepted code. Upon successful authentication, the attacker receives OAuth access and refresh tokens that grant persistent access to Exchange Online, Teams, OneDrive, and SharePoint—surviving both multi-factor authentication and subsequent password changes.

The platform comprises three distinct editions (E1, E2, E3) with escalating post-compromise capabilities. Edition 1 provides basic token capture and mailbox proxy access via a React-based single-page application with 33+ built-in lure templates impersonating Adobe Acrobat Sign, DocuSign, SharePoint, and OneDrive. Edition 2 layers sophisticated post-compromise automation: an AI-powered Business Email Compromise (BEC) module that analyzes captured mailbox threads to identify high-value targets (wire transfers, invoices, payroll), generates fraudulent replies, and tiers opportunities by fraud scoring. Edition 3 enables self-service cryptocurrency payments and reseller affiliate capabilities via Telegram distribution channels. All editions integrate OxaPay cryptocurrency payment processing and Cloudflare Turnstile bot protection, with infrastructure spanning 240+ compromised IP addresses in the AS132203 (Tencent Cloud) CIDR range. The campaign reached peak activity on May 20, 2026, with 80+ successful authentication events captured in a single day, prompting an FBI critical Public Service Alert on May 21, 2026. Infrastructure evolution includes domain rotation (kali365.xyz → octopi365.com → blackoctopusking.live ~May 7, 2026) and operator expansion into related campaigns targeting MAX Messenger (110M+ registered users) and other cloud platforms. Post-compromise attack chains include mailbox rule creation to suppress security notifications, lateral phishing from compromised accounts to organizational contacts, credential harvesting via forwarding rules, and coordinated BEC operations facilitated by the E2 module's AI-powered targeting.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1598.002 Spearphishing Attachment
- T1204.001 Malicious Link
- T1098.001 Additional Cloud Credentials
- T1098.003 Additional Cloud Roles
- T1136.003 Cloud Account
- T1548 Abuse Elevation Control Mechanism
- T1556 Modify Authentication Process
- T1550.001 Application Access Token
- T1078.004 Cloud Accounts
- T1027.006 HTML Smuggling
- T1578 Modify Cloud Compute Infrastructure
- T1187 Forced Authentication
- T1110.004 Credential Stuffing
- T1111 Multi-Factor Authentication Interception
- T1589.003 Employee Names
- T1087.004 Cloud Account
- T1580 Cloud Infrastructure Discovery
- T1526 Cloud Service Discovery
- T1021 Remote Services
- T1114.001 Local Email Collection
- T1020 Automated Exfiltration
- T1114.002 Remote Email Collection
- T1048 Exfiltration Over Alternative Protocol
- T1657 Financial Theft
- T1591.004 Identify Roles

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0984