# Kali365 Phishing-as-a-Service Kit Abuses Microsoft Device Code Authentication to Hijack Microsoft 365 Accounts

> Kali365, a Telegram-distributed phishing-as-a-service platform active since April 2026, abuses Microsoft's legitimate OAuth 2.0 Device Authorization Grant flow to hijack Microsoft 365 accounts without stealing passwords. Victims are directed to Microsoft's authentic device login portal (microsoft.com/devicelogin) and enter an attacker-supplied code, which grants the attacker OAuth access and refresh tokens that survive password changes and bypass MFA entirely.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1641
- **ID:** TL-2026-1641
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** Kali365 PhaaS operators (Russia)
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Kali365 is an emerging Phishing-as-a-Service (PhaaS) platform first observed in April 2026 and sold via Telegram channels and a reseller/affiliate network for as little as $250/month or $2,000/year. Unlike traditional credential-phishing kits that rely on lookalike domains and fake login forms, Kali365 abuses the OAuth 2.0 Device Authorization Grant flow (RFC 8628) — a legitimate mechanism designed for input-constrained devices (smart TVs, IoT, CLI tools). The kit sends phishing emails and messages impersonating trusted cloud services (SharePoint, OneDrive, Teams, Outlook, Voicemail, Adobe Acrobat Sign, DocuSign) that instruct the victim to visit Microsoft's genuine device login page (https://microsoft.com/devicelogin) and enter an attacker-generated device code. Because the victim lands on Microsoft's real, correctly-certificated domain and performs a normal-looking authentication (including satisfying their own MFA), there is no lookalike domain, no credential-harvesting form, and no suspicious redirect for conventional phishing detection to catch. Once the victim approves the device code, the OAuth authorization server issues access and refresh tokens to the attacker-controlled application/device rather than the victim's device. These tokens grant the attacker persistent, MFA-bypassing access to the victim's mailbox, SharePoint, and OneDrive content that survives password resets and remains valid until explicitly revoked.

Deobfuscated Kali365 JavaScript shows a structured toolkit: a bot/verification gate (to filter automated scanners and sandboxes from real victims), a phishing-page deployment module, a live poll against a `/api/status/` endpoint tracking session states of `captured`, `expired`, and `declined`, and a library of lure-template generators themed as OneDrive, SharePoint, Teams, Outlook, and Voicemail notifications, plus a parallel Google device-code authentication flow for targeting Google Workspace accounts. The kit also ships AI-generated lure content in at least 15 languages, lowering the barrier for non-English-speaking affiliates. A secondary "Cookie Link" adversary-in-the-middle (AitM) capability uses a reverse proxy to transparently relay victims through attacker infrastructure, capturing session cookies and tokens even after the victim completes legitimate MFA challenges.

Post-compromise, the platform automates account takeover persistence: on receipt of captured tokens it can silently create malicious Outlook inbox rules that reroute or suppress incoming mail containing security-alert keywords (hiding password-reset notices and suspicious-sign-in warnings from the victim), register attacker devices into the victim's Entra ID tenant, and pivot to sending further internal phishing from the now-trusted compromised mailbox. ANY.RUN sandbox telemetry recorded more than 80 public interactive-analysis sessions per week tied to Kali365 samples, and observed a cluster of phishing pages hosted on `.de` ccTLD infrastructure. Documented targeting spans MSSPs, manufacturing, technology, government, healthcare, consulting, financial services, insurance, and education across North America, Europe, EMEA, Australia, and New Zealand — essentially any organization that relies on Microsoft 365.

Kali365's technique is not novel in isolation: Microsoft's own threat intelligence team documented the same OAuth device-code abuse technique from the Russia-aligned actor Storm-2372, active since at least August 2024, which used Teams/WhatsApp/Signal rapport-building lures and fake meeting invitations to harvest device codes from government, NGO, IT services, defense, telecom, health, higher-education, and energy-sector targets across Europe, North America, Africa, and the Middle East. Storm-2372 later escalated by abusing the Microsoft Authentication Broker client ID to acquire Primary Refresh Tokens (PRTs) and register attacker devices directly in Entra ID for sustained access, then used Microsoft Graph API searches for keywords such as "password," "credentials," "admin," "teamviewer," "anydesk," and "secret" to locate and exfiltrate sensitive email. Kali365 commoditizes this same device-code-abuse tradecraft into an affordable, turnkey criminal PhaaS offering usable by low-skill affiliates, dramatically expanding the pool of operators employing this MFA-bypass technique. The FBI/IC3 issued a public service announcement (I-052126-PSA, May 21 2026) specifically naming Kali365 and recommending organizations create Conditional Access policies to block device code flow entirely except for narrowly scoped, audited exceptions.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1078.004 Cloud Accounts
- T1528 Steal Application Access Token
- T1598.004 Spearphishing Voice
- T1550.001 Application Access Token
- T1556 Modify Authentication Process
- T1098 Account Manipulation
- T1098.005 Device Registration
- T1114.002 Remote Email Collection
- T1119 Automated Collection
- T1538 Cloud Service Dashboard
- T1087.004 Cloud Account
- T1534 Internal Spearphishing
- T1537 Transfer Data to Cloud Account
- T1102 Web Service
- T1583.001 Domains
- T1587.001 Malware
- T1589.002 Email Addresses

## Sources

- [Kali365 Phishing Kit Abuses Microsoft Device Codes to Hijack Microsoft 365 Accounts](https://cybersecuritynews.com/kali365-phishing-kit-microsoft-device-codes/)
- [Kali365 Malware Analysis, Overview by ANY.RUN](https://any.run/malware-trends/kali365/)
- [Kali365: PhaaS Overview](https://medium.com/@anyrun/kali365-phaas-overview-9906627c5e1b)
- [FBI warns of Kali365 phishing kit that breaks into Microsoft 365 accounts — no password required](https://www.bitdefender.com/en-us/blog/hotforsecurity/fbi-kali365-phishing-kit-breaks-microsoft-365-accounts-no-password-required)
- [Kali365 phishing kit bypasses MFA and steals Microsoft logins](https://www.malwarebytes.com/blog/scams/2026/05/kali365-phishing-kit-bypasses-mfa-and-steals-microsoft-logins)
- [Kali365: The New Phishing Kit Hijacking Microsoft 365 Tokens](https://www.doppel.com/blog/kali365-phishing-kit)
- [Internet Crime Complaint Center (IC3) PSA260521 — Kali365 Phishing-as-a-Service Kit Hijacks Microsoft 365 Access Tokens](https://www.ic3.gov/PSA/2026/PSA260521)
- [FBI Warns of Kali365 Phishing Kit Hijacking Microsoft 365](https://www.purpleshieldsecurity.com/post/kali365-microsoft-365-phishing-mfa-bypass)
- [Storm-2372 conducts device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)
- [Storm-2372 Launches Device Code Phishing Campaign Targeting Microsoft 365 Accounts](https://www.quorumcyber.com/threat-intelligence/storm-2372-launches-device-code-phishing-campaign-targeting-microsoft-365-accounts/)
- [Hackers Hijack Microsoft Entra Accounts via Device Code Phishing](https://winbuzzer.com/2026/02/20/hackers-hijack-microsoft-entra-accounts-device-code-phishing-xcxwbn/)
- [Storm-2372: Russia-Linked Hackers Exploit Microsoft 365 Device Code Phishing for Account Takeovers](https://www.rescana.com/post/storm-2372-russia-linked-hackers-exploit-microsoft-365-device-code-phishing-for-account-takeovers)
- [Defending against evolving identity attack techniques](https://www.microsoft.com/en-us/security/blog/2025/05/29/defending-against-evolving-identity-attack-techniques/)
- [OAuth Device Code Phishing Hits 340+ Microsoft 365 Organizations](https://labs.cloudsecurityalliance.org/research/csa-research-note-oauth-device-code-phishing-m365-20260325-c/)
- [The Device Code Vulnerability: Storm-2372's Blueprint for Bypassing MFA Through Microsoft's Own Authentication](https://www.dts-solution.com/the-device-code-vulnerability-storm-2372s-blueprint-for-bypassing-mfa-through-microsofts-own-authentication/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1641