Full Report
Kali365, which was first observed in April, abuses legitimate Microsoft device authorization pages to grant persistent access to cybercriminal-controlled applications. The post FBI warns about fast-growing phishing kit targeting Microsoft 365 users appeared first on CyberScoop.
Analysis Summary
# Tool/Technique: Kali365
## Overview
Kali365 is a Phishing-as-a-Service (PaaS) platform that specializes in "device-code phishing." Unlike traditional phishing that steals usernames and passwords, Kali365 facilitates the abuse of legitimate Microsoft OAuth device authorization flows. This allows attackers to gain persistent access to Microsoft 365 accounts by tricking users into authorizing a malicious application, effectively bypassing Multi-Factor Authentication (MFA).
## Technical Details
- **Type:** Phishing-as-a-Service (PaaS) / Phishing Kit
- **Platform:** Microsoft 365 (SaaS)
- **Capabilities:** AI-generated lures, automated campaign templates, OAuth token capture, and persistent session management.
- **First Seen:** April 2026 (Reported by FBI/Arctic Wolf)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1566.002 - Phishing: Spearphishing Link]**
- **[TA0006 - Credential Access]**
- **[T1528 - Steal or Forge Authentication Tokens]**
- **[TA0003 - Persistence]**
- **[T1136.003 - Create Account: Cloud Account]** (Abuse of OAuth App permissions)
- **[TA0005 - Defense Evasion]**
- **[T1550.001 - Use Alternate Authentication Material: Application Access Token]**
## Functionality
### Core Capabilities
- **Device Code Abuse:** Generates a code that the victim is prompted to enter into a legitimate Microsoft authorization page (`microsoft[.]com/devicelogin`).
- **MFA Bypass:** Because the flow uses legitimate Microsoft infrastructure for authentication, the "approval" of the device code inherently satisfies MFA requirements.
- **Token Capture:** Automatically harvests and stores OAuth access and refresh tokens.
- **Service Persistence:** Uses refresh tokens to maintain long-term access to the victim’s environment without requiring the user's password.
### Advanced Features
- **Phishing-as-a-Service Model:** Operates on a subscription basis ($250/month or $2,000/year) for affiliates.
- **AI-Driven Lures:** Utilizes AI to generate sophisticated and convincing phishing content.
- **Dashboard Tracking:** Provides attackers with real-time tracking of targeted individuals and campaign success rates.
- **Token Sharing:** Enables the redistribution of captured tokens among different threat actors.
## Indicators of Compromise
*Note: Indicators are based on the behavioral patterns described in the report.*
- **File Hashes:** N/A (Web-based toolkit)
- **File Names:** N/A
- **Registry Keys:** N/A
- **Network Indicators:**
- `microsoft[.]com/devicelogin` (Legitimate site used in the flow)
- Telegram (Primary distribution and C2 communication channel for the toolkit)
- **Behavioral Indicators:**
- Login events from unusual locations associated with "Microsoft Office" or "Command Line" application IDs.
- Unexpected OAuth application registrations in the Azure AD / Entra ID tenant.
## Associated Threat Actors
- Distributed primarily to various cybercriminal affiliates via **Telegram**. Specific named groups were not identified in the initial FBI warning, though it is used by a broad range of low-to-mid-level attackers.
## Detection Methods
- **Behavioral Detection:** Monitor for "Device Code Flow" authentication events in Microsoft Entra ID (formerly Azure AD) sign-in logs, especially those originating from unexpected IP addresses.
- **Application Monitoring:** Audit the tenant for the authorization of new, suspicious Enterprise Applications that request extensive permissions (e.g., `Mail.Read`, `Files.ReadWrite.All`).
- **Log Analysis:** Look for instances where users navigate to the device login page immediately followed by a successful token issuance to a third-party app.
## Mitigation Strategies
- **Conditional Access Policies:** Restrict or disable Device Code Flow if it is not required for business operations.
- **User Education:** Train employees to never enter a code into a website unless they personally initiated a login request on a non-traditional device (like a smart TV).
- **Phishing Protections:** Implement advanced email filtering that can identify the specific language patterns used in device-code phishing lures.
- **App Consent Settings:** Configure "Admin Consent" requirements so users cannot authorize new applications without IT approval.
## Related Tools/Techniques
- **Adversary-in-the-Middle (AiTM):** Similar MFA-bypass goal, but uses a proxy to steal session cookies rather than OAuth tokens.
- **EvilProxy / NakedPages:** Other prominent Phishing-as-a-Service platforms.
- **OAuth App Consent Phishing:** General technique of tricking users into granting permissions to a malicious OAuth application.