Kali365 Device-Code Phishing-as-a-Service Hijacks Microsoft 365 and Google Workspace OAuth Tokens to Bypass MFA
Kali365 Device-Code Phishing-as-a-Service Hijacks Microsoft (TL-2026-1584), also tracked as Kali365, is a high-severity phishing campaign, first published 2026-07-21. It has no confirmed attribution, affects Microsoft Microsoft Entra ID / Microsoft 365 (Outlook, Teams, maps to 20 MITRE ATT&CK techniques (T1071.001, T1078.004, T1098.003), and is covered by 9 detection rules and 41 indicators of compromise.
Key facts for TL-2026-1584
- Threat ID
- TL-2026-1584
- Also known as
- Kali365, Kali365 PhaaS, Kali365 Device Code Phishing Kit
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-07-21
- Last reviewed
- 2026-07-21
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- mssp, manufacturing, technology, government administration, publicadministration, health, consulting
- Target regions
- North America, united states of america, Europe
- Detection rules
- 9
- Indicators of compromise
- 41
Malware and tooling in Kali365 Device-Code Phishing-as-a-Service Hijacks Microsoft
Malware and tooling: Kali365
Kali365 is a Phishing-as-a-Service (PhaaS) kit, first observed in April 2026 and distributed via Telegram, that abuses the legitimate OAuth 2.0 Device Authorization Grant flow of Microsoft and Google to steal access and refresh tokens without touching passwords or triggering MFA. ANY.RUN sandbox telemetry recorded 80+ public analysis sessions weekly with the United States as the primary target, hitting MSSPs, manufacturing, technology, government/public administration, healthcare, and consulting sectors; the FBI/IC3 issued PSA I-052126-PSA on 21 May 2026 warning of active exploitation.
How Kali365 Device-Code Phishing-as-a-Service Hijacks Microsoft works
Kali365 is a subscription-based Phishing-as-a-Service platform (advertised at roughly US $250/month or $2,000/year on Telegram) that operationalizes device-code phishing — an OAuth 2.0 Device Authorization Grant abuse technique first weaponized at scale by the Russia-aligned threat cluster Storm-2372 (also tracked as APT29, UTA0304, UTA0307, and UNK_AcademicFlare) beginning in August 2024 and publicly documented by Microsoft and Volexity in February 2025. Kali365 packages that technique into a turnkey kit usable by non-technical operators.
The attack begins with a phishing lure — email or chat message — impersonating a trusted cloud productivity brand (OneDrive, SharePoint, Microsoft Teams, Outlook, OneNote, Google Drive, DocuSign, Adobe, and 26 additional AI-generated templates covering Microsoft Admin, Microsoft Security, Teams Meeting, Microsoft Forms, Planner, Calendar, Power Automate, Sway, Stream, Whiteboard, Bookings, Intune, Yammer, Loop, Copilot, To Do, OneDrive for Business, SharePoint News, Teams Approval, Password Reset, MFA Setup, and Quarantined Messages notifications). The lure page requests the target's phone number or email for tracking (verification gate) and then displays an authentic Microsoft- or Google-issued device code, instructing the victim to enter it at the real endpoint (login.microsoftonline.com/common/oauth2/deviceauth for Microsoft, and the equivalent Google device endpoint). Because the victim authenticates on the vendor's genuine, correctly-TLS-signed login page, no credential-harvesting page, password prompt, or MFA challenge is ever presented to them — the attack is invisible to conventional anti-phishing indicators, URL reputation, and MFA controls.
Once the victim approves the device code, Microsoft or Google issues a valid OAuth access token and refresh token to the attacker-controlled polling session. Kali365's backend polls /api/status/<number> (Microsoft flow) or /api/google/status/<number> (Google flow) until the session state transitions to "captured", at which point the platform delivers the stolen tokens to the operator's dashboard. Refresh tokens obtained this way persist across victim password resets, giving the attacker durable, MFA-bypassing access to Outlook, Teams, OneDrive, SharePoint, and other Microsoft Graph / Google Workspace resources tied to the granted application scope. Kali365 differentiates itself from earlier device-code kits with built-in post-compromise automation: on token capture it can automatically create malicious inbox rules in the compromised mailbox (a classic BEC persistence/collection technique) without further operator action, and it exposes a real-time dashboard for tracking individual targets and campaign session states (created, captured, expired, declined).
Infrastructure observed in ANY.RUN sandbox telemetry consists of dozens of freshly-registered, mostly .de and a handful of .xyz/.net/.com/.top second-level domains fronting the phishing lure pages, plus at least one Cloudflare Workers subdomain (cloud-microsoft-drive-for-business.workers.dev) used to host a Microsoft-branded lure — consistent with FBI IC3 guidance noting Kali365 operators favor disposable cloud-hosted infrastructure such as workers.dev to minimize takedown friction and blend with legitimate Microsoft-adjacent naming. Session configuration is driven by two backend parameters, design (selects which of the 34 lure templates renders) and flow_type (selects Microsoft or Google as the OAuth provider), retrievable via /api/lure-config/<ID> and generated via /api/generate?lure=<ID>.
The FBI/IC3 PSA (I-052126-PSA, 21 May 2026) recommends organizations create a Conditional Access policy in Microsoft Entra ID that blocks the device code authentication flow globally, audit legitimate business dependencies on device code flow before restricting it, disable authentication-state transfer between devices, maintain break-glass emergency access accounts excluded from the block policy, revoke all active refresh/session tokens for any user suspected of compromise, and report confirmed incidents to IC3. Analysts investigating suspected Kali365 activity should correlate sign-in logs for device-code grant type events with anomalous IP/geolocation, examine encrypted lure scripts and redirect chains via browser-level sandbox analysis (e.g., ANY.RUN), extract lure IDs and backend API paths from captured network traffic, and audit mailbox inbox-rule creation events immediately following any device-code grant.
MITRE ATT&CK techniques used in TL-2026-1584
Command and Control
T1071.001 Web Protocols; T1102 Web Service
Defense Evasion
Persistence
T1098.003 Additional Cloud Roles
Credential Access
T1110.001 Password Guessing; T1111 Multi-Factor Authentication Interception; T1528 Steal Application Access Token
Collection
T1114.002 Remote Email Collection
collection
T1114.003 Email Forwarding Rule
Initial Access
T1199 Trusted Relationship; T1566.002 Spearphishing Link
Execution
Impact
Discovery
lateral-movement
T1550.001 Application Access Token
Resource Development
T1583.001 Domains; T1585.001 Social Media Accounts; T1587.001 Malware
Reconnaissance
stealth
Affected products and versions in Kali365 Device-Code Phishing-as-a-Service Hijacks Microsoft
- Microsoft — Microsoft Entra ID / Microsoft 365 (Outlook, Teams, OneDrive, SharePoint) OAuth 2.0 Device Authorization Grant
Vulnerable versions: all tenants with device code flow enabled
Fixed in: tenants with Conditional Access policy blocking device code flow - Google — Google Workspace OAuth 2.0 Device Authorization Grant
Vulnerable versions: all accounts with device code flow enabled
Fixed in: accounts with device code flow restricted via admin policy
Remediation for Kali365 Device-Code Phishing-as-a-Service Hijacks Microsoft
Immediate actions
- Create a Microsoft Entra ID Conditional Access policy blocking the OAuth 2.0 device code authorization flow globally for all users
- Revoke all active access and refresh tokens and session cookies for any user suspected of device-code compromise
- Audit compromised mailboxes for newly-created inbox rules (auto-forward, delete, move-to-folder) and remove any unauthorized rules
- Block or sinkhole known Kali365 lure domains at DNS/proxy/email-gateway layer
- Report confirmed Kali365 compromises to the FBI Internet Crime Complaint Center (IC3)
Workarounds
- Audit and document legitimate business use cases for device code flow before disabling it tenant-wide
- Maintain at least one break-glass emergency-access account explicitly excluded from the device-code-blocking Conditional Access policy
- Disable Microsoft Entra ID authentication-state transfer between devices to reduce device-code abuse surface
Longer-term hardening
- Deploy identity-provider alerting on device-code grant-type sign-ins correlated with anomalous geolocation or ASN
- Restrict OAuth application consent to admin-approved applications only (disable user consent for third-party apps)
- Deploy EDR/CASB behavioral detection for anomalous Microsoft Graph / Google Workspace API usage following token issuance
- Train users to recognize device-code social-engineering lures, including Teams-meeting and chat-based pretexting vectors
- Establish a recurring audit cadence for mailbox inbox-rule creation across the tenant
Weaknesses (CWE) in Kali365 Device-Code Phishing-as-a-Service Hijacks Microsoft
CWE-287, CWE-290, CWE-346
Timeline of Kali365 Device-Code Phishing-as-a-Service Hijacks Microsoft
- Storm-2372 (Russia-aligned, moderate confidence) begins device-code phishing operations against governments, NGOs, and multiple industries across regions
- Microsoft and Volexity publicly document Storm-2372's device-code phishing campaign, first weaponizing the OAuth 2.0 Device Authorization Grant abuse technique at scale
- Microsoft Security Blog publishes guidance on defending against evolving identity attack techniques including device-code abuse
- DTS Solution publishes technical breakdown of the Storm-2372 device-code MFA-bypass blueprint
- Device-code phishing campaigns reported to have hit 340+ Microsoft 365 organizations across five countries via OAuth abuse
- Kali365 Phishing-as-a-Service kit first observed in the wild, promoted primarily through Telegram channels
- Security researchers document hundreds of Kali365 attacks in April 2026 alone, hitting organizations across North America and Europe
- FBI Internet Crime Complaint Center issues PSA I-052126-PSA warning of Kali365 Phishing-as-a-Service kit hijacking Microsoft 365 access tokens
- Bitdefender, Malwarebytes, and Purple Shield Security publish coverage of the FBI Kali365 alert and MFA-bypass mechanics
- ANY.RUN publishes a PhaaS overview of Kali365, detailing deobfuscated JavaScript, /api/status/ polling behavior, and lure-template generators
- Doppel publishes technical analysis of Kali365's four-step device-code relay and blind-authorization attack flow
- ANY.RUN reports Kali365 primarily targeting United States organizations, citing 80+ public sandbox sessions weekly across MSSP, manufacturing, technology, government, healthcare, and consulting sectors, and publishes the 34-lure-template and IOC list
Sources cited for Kali365 Device-Code Phishing-as-a-Service Hijacks Microsoft
- Kali365 Device Code Phishing Targeting US Organizations
- Kali365 Malware Analysis, Overview by ANY.RUN
- Kali365: PhaaS Overview
- FBI warns of Kali365 phishing kit that breaks into Microsoft 365 accounts — no password required
- Kali365 phishing kit bypasses MFA and steals Microsoft logins
- Kali365: The New Phishing Kit Hijacking Microsoft 365 Tokens
- Internet Crime Complaint Center (IC3) PSA — Kali365 Phishing-as-a-Service Kit Hijacks Microsoft 365 Access Tokens (I-052126-PSA)
- FBI Warns of Kali365 Phishing Kit Hijacking Microsoft 365
- Storm-2372 conducts device code phishing campaign
- Defending against evolving identity attack techniques
- Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse
- The Device Code Vulnerability: Storm-2372's Blueprint for Bypassing MFA Through Microsoft's Own Authentication
Threats related to Kali365 Device-Code Phishing-as-a-Service Hijacks Microsoft
- Misconfigured Server Exposes Three Evilginx-Based Microsoft 365 Phishing Operations (codemado, mail-argenta, saroula01)
- Kali365 Phishing-as-a-Service Kit Abuses Microsoft Device Code Authentication to Hijack Microsoft 365 Accounts
- EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device Code Authentication with AES-GCM "Ghost Code" to Breach Finance, Tech, and Managed Security Firms
- ARToken: Business Email Compromise-as-a-Service Platform Targeting Microsoft 365 (Cisco Talos / EvilTokens Affiliate)
- "The Procurement Trap": AiTM Phishing-as-a-Service Campaign (EvilProxy, FlowerStorm/Storm-1167, Kali365) Targeting Universities, EU/UN Agencies, and Multinational Institutions
- Browser-in-the-Browser Phishing Campaign Impersonates 34+ Brands' Job Postings to Steal Google Account Credentials
Detection coverage for TL-2026-1584
As of 2026-07-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1584 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.