Kali365 phishes Microsoft's own device login page for durable Microsoft 365 tokens
ANY.RUN documented Kali365, a kit that lures victims through fake SharePoint, OneDrive, and DocuSign pages to Microsoft's genuine device login portal, where approving an attacker-supplied code hands over access and refresh tokens.
ANY.RUN researchers detailed Kali365 on August 5, 2026, a phishing kit that turns Microsoft's legitimate device login portal into the attack surface. Victims hit a lure impersonating SharePoint, OneDrive, or DocuSign, get redirected to the genuine Microsoft device login page, and enter an attacker-supplied code. Approving it issues the attacker access and refresh tokens with continued reach into Microsoft 365 mail, documents, and cloud resources. Because every page the victim actually sees is real Microsoft infrastructure, the usual phishing tells are absent. ANY.RUN telemetry shows more than 80 public sessions a week. Targets skew to US manufacturing, technology, healthcare, government, consulting, and managed security providers.
Why it matters
Kali365 is the commodity version of the technique three state-linked crews adopted the same month. That is the pattern worth tracking: device-code flow abuse has moved from espionage tradecraft to a kit anyone can rent. Traditional user training fails here because there is nothing fake to spot on the login page, and domain-based blocklists fail because the domain is login.microsoftonline.com. The controls that work are policy-level. Disable device-code flow for tenants that do not need it, use Conditional Access to require a compliant device for token issuance, and alert specifically on device-code grants. Follow-on damage is invoice fraud and mailbox access, so pair this with the token theft response checklist.
Source: The Hacker News
Related on Start with Identity
- BlogConsentFix: hijacking Microsoft 365 through the OAuth consent flow
ConsentFix adapts the ClickFix pattern to identity. Instead of running a command on the victim's machine, it walks them through an OAuth consent flow and asks t
- BlogDevice code phishing industrialises: 25 kits, and Microsoft counts new campaigns daily
The OAuth device authorization flow built for smart TVs is now a phishing-as-a-service product line. Microsoft reported 10 to 15 new campaigns every 24 hours by
- BlogEntra passkey enrollment vishing targets Microsoft 365 users
An extortion crew tracked as Pink phones employees claiming they must enroll a new Entra passkey, then walks them through a relay panel that registers the attac
- RecipeAdd login to a Next.js app with OIDC
A complete, copy-paste OpenID Connect login for the Next.js App Router using authorization code flow with PKCE, server-side token exchange, and httpOnly cookies
- GuideConditional Access Policies: A Complete Implementation Guide for Microsoft Entra
Master Microsoft Entra conditional access with risk-based policies, device compliance rules, location-based restrictions, and real-world deployment patterns.
- Comparisoncrowdstrike-falcon-identity-vs-microsoft-defender-identity
Both bring identity threat detection and response (ITDR) to the directory layer, watching Active Directory and Entra ID for attacks like credential theft, later