# Kali365 Device-Code Phishing-as-a-Service Hijacks Microsoft 365 and Google Workspace OAuth Tokens to Bypass MFA

> Kali365 is a Phishing-as-a-Service (PhaaS) kit, first observed in April 2026 and distributed via Telegram, that abuses the legitimate OAuth 2.0 Device Authorization Grant flow of Microsoft and Google to steal access and refresh tokens without touching passwords or triggering MFA. ANY.RUN sandbox telemetry recorded 80+ public analysis sessions weekly with the United States as the primary target, hitting MSSPs, manufacturing, technology, government/public administration, healthcare, and consulting sectors; the FBI/IC3 issued PSA I-052126-PSA on 21 May 2026 warning of active exploitation.

- **Published:** 2026-07-21T00:00:00Z
- **Last reviewed:** 2026-07-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1584
- **ID:** TL-2026-1584
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 41 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Kali365 is a subscription-based Phishing-as-a-Service platform (advertised at roughly US $250/month or $2,000/year on Telegram) that operationalizes device-code phishing — an OAuth 2.0 Device Authorization Grant abuse technique first weaponized at scale by the Russia-aligned threat cluster Storm-2372 (also tracked as APT29, UTA0304, UTA0307, and UNK_AcademicFlare) beginning in August 2024 and publicly documented by Microsoft and Volexity in February 2025. Kali365 packages that technique into a turnkey kit usable by non-technical operators.

The attack begins with a phishing lure — email or chat message — impersonating a trusted cloud productivity brand (OneDrive, SharePoint, Microsoft Teams, Outlook, OneNote, Google Drive, DocuSign, Adobe, and 26 additional AI-generated templates covering Microsoft Admin, Microsoft Security, Teams Meeting, Microsoft Forms, Planner, Calendar, Power Automate, Sway, Stream, Whiteboard, Bookings, Intune, Yammer, Loop, Copilot, To Do, OneDrive for Business, SharePoint News, Teams Approval, Password Reset, MFA Setup, and Quarantined Messages notifications). The lure page requests the target's phone number or email for tracking (verification gate) and then displays an authentic Microsoft- or Google-issued device code, instructing the victim to enter it at the real endpoint (login.microsoftonline.com/common/oauth2/deviceauth for Microsoft, and the equivalent Google device endpoint). Because the victim authenticates on the vendor's genuine, correctly-TLS-signed login page, no credential-harvesting page, password prompt, or MFA challenge is ever presented to them — the attack is invisible to conventional anti-phishing indicators, URL reputation, and MFA controls.

Once the victim approves the device code, Microsoft or Google issues a valid OAuth access token and refresh token to the attacker-controlled polling session. Kali365's backend polls /api/status/<number> (Microsoft flow) or /api/google/status/<number> (Google flow) until the session state transitions to "captured", at which point the platform delivers the stolen tokens to the operator's dashboard. Refresh tokens obtained this way persist across victim password resets, giving the attacker durable, MFA-bypassing access to Outlook, Teams, OneDrive, SharePoint, and other Microsoft Graph / Google Workspace resources tied to the granted application scope. Kali365 differentiates itself from earlier device-code kits with built-in post-compromise automation: on token capture it can automatically create malicious inbox rules in the compromised mailbox (a classic BEC persistence/collection technique) without further operator action, and it exposes a real-time dashboard for tracking individual targets and campaign session states (created, captured, expired, declined).

Infrastructure observed in ANY.RUN sandbox telemetry consists of dozens of freshly-registered, mostly .de and a handful of .xyz/.net/.com/.top second-level domains fronting the phishing lure pages, plus at least one Cloudflare Workers subdomain (cloud-microsoft-drive-for-business.workers.dev) used to host a Microsoft-branded lure — consistent with FBI IC3 guidance noting Kali365 operators favor disposable cloud-hosted infrastructure such as workers.dev to minimize takedown friction and blend with legitimate Microsoft-adjacent naming. Session configuration is driven by two backend parameters, design (selects which of the 34 lure templates renders) and flow_type (selects Microsoft or Google as the OAuth provider), retrievable via /api/lure-config/<ID> and generated via /api/generate?lure=<ID>.

The FBI/IC3 PSA (I-052126-PSA, 21 May 2026) recommends organizations create a Conditional Access policy in Microsoft Entra ID that blocks the device code authentication flow globally, audit legitimate business dependencies on device code flow before restricting it, disable authentication-state transfer between devices, maintain break-glass emergency access accounts excluded from the block policy, revoke all active refresh/session tokens for any user suspected of compromise, and report confirmed incidents to IC3. Analysts investigating suspected Kali365 activity should correlate sign-in logs for device-code grant type events with anomalous IP/geolocation, examine encrypted lure scripts and redirect chains via browser-level sandbox analysis (e.g., ANY.RUN), extract lure IDs and backend API paths from captured network traffic, and audit mailbox inbox-rule creation events immediately following any device-code grant.

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1583.001 Domains
- T1587.001 Malware
- T1585.001 Social Media Accounts
- T1566.002 Spearphishing Link
- T1199 Trusted Relationship
- T1204.001 Malicious Link
- T1098.003 Additional Cloud Roles
- T1114.003 Email Forwarding Rule
- T1550.001 Application Access Token
- T1684.001 Impersonation
- T1078.004 Cloud Accounts
- T1528 Steal Application Access Token
- T1111 Multi-Factor Authentication Interception
- T1110.001 Password Guessing
- T1538 Cloud Service Dashboard
- T1114.002 Remote Email Collection
- T1102 Web Service
- T1071.001 Web Protocols
- T1531 Account Access Removal

## Sources

- [Kali365 Device Code Phishing Targeting US Organizations](https://any.run/cybersecurity-blog/kali365-phishing-targeting-us/)
- [Kali365 Malware Analysis, Overview by ANY.RUN](https://any.run/malware-trends/kali365/)
- [Kali365: PhaaS Overview](https://medium.com/@anyrun/kali365-phaas-overview-9906627c5e1b)
- [FBI warns of Kali365 phishing kit that breaks into Microsoft 365 accounts — no password required](https://www.bitdefender.com/en-us/blog/hotforsecurity/fbi-kali365-phishing-kit-breaks-microsoft-365-accounts-no-password-required)
- [Kali365 phishing kit bypasses MFA and steals Microsoft logins](https://www.malwarebytes.com/blog/scams/2026/05/kali365-phishing-kit-bypasses-mfa-and-steals-microsoft-logins)
- [Kali365: The New Phishing Kit Hijacking Microsoft 365 Tokens](https://www.doppel.com/blog/kali365-phishing-kit)
- [Internet Crime Complaint Center (IC3) PSA — Kali365 Phishing-as-a-Service Kit Hijacks Microsoft 365 Access Tokens (I-052126-PSA)](https://www.ic3.gov/PSA/2026/PSA260521)
- [FBI Warns of Kali365 Phishing Kit Hijacking Microsoft 365](https://www.purpleshieldsecurity.com/post/kali365-microsoft-365-phishing-mfa-bypass)
- [Storm-2372 conducts device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)
- [Defending against evolving identity attack techniques](https://www.microsoft.com/en-us/security/blog/2025/05/29/defending-against-evolving-identity-attack-techniques/)
- [Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse](https://thehackernews.com/2026/03/device-code-phishing-hits-340-microsoft.html)
- [The Device Code Vulnerability: Storm-2372's Blueprint for Bypassing MFA Through Microsoft's Own Authentication](https://www.dts-solution.com/the-device-code-vulnerability-storm-2372s-blueprint-for-bypassing-mfa-through-microsofts-own-authentication/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1584