Threat video1:00
Kali365 Fake AI Event Phishing: Detection & IOCs
Kali365 device code phishing and VoidProxy reverse proxying steal Microsoft and Google sessions. 9 detection rules, 22 IOCs and a free Splunk SPL rule.
Read the full threat intel for Kali365 Fake AI Event Phishing: Detection & IOCs →
Chapters
- 0:00The hookThree fake events harvested cloud credentials.
- 0:04The storyAttackers used fake AI events, stealing Microsoft and Google credentials.
- 0:11Attack pathDevice code phishing drew victims to fake pages, stealing their Microsoft and Google credentials.
- 0:28AttributionNo threat actor: this was defensive research.
- 0:32Indicators of compromise9 indicators to hunt: 2 domains, 2 registry keys and 5 hostings.
- 0:38MITRE ATT&CK techniques10 ATT&CK techniques, from initial access to command and control.
- 0:43Remediation3 steps now: Hunt Entra ID sign-in logs for device code flow authentications.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Three fake events harvested cloud credentials.
0:05Attackers used fake AI events, stealing Microsoft and Google credentials.
0:10Stopped cold.
0:12Device code phishing drew victims to fake pages, stealing their Microsoft and Google credentials.
0:18Reverse proxy attack captured MFA responses and sessions.
0:23Attackers replayed tokens to seize accounts.
0:28No threat actor: this was defensive research.
0:329 indicators to hunt: 2 domains, 2 registry keys and 5 hostings.
0:3910 ATT&CK techniques, from initial access to command and control.
0:443 steps now: Hunt Entra ID sign-in logs for device code flow authentications.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.