Kali365 is targeting US organizations with device code phishing attacks that abuse legitimate Microsoft authentication. Instead of directing victims to a fake login form, the phishkit sends them to a real Microsoft page, where they authorize access using an attacker-controlled device code.

This makes the attack harder for analysts to spot and more dangerous for the business. By obtaining OAuth access and refresh tokens, attackers may gain continued access to Microsoft 365 accounts, corporate email, documents, and cloud resources without stealing the victim’s password directly.

Kali365 Attack Overview

Kali365 is a phishing kit that uses the Device Code Phishing technique. These attacks abuse Microsoft’s legitimate device authentication process: the victim isshown a user code and persuaded to enter it on the authentic Microsoft Device Login page.

Once the victim successfully authenticates, the attackers obtain the OAuth access and refresh tokens issued to the application or client that initiated the device code flow.

As a result, the risk shifts from traditional credential theft to the abuse of access and refresh tokens. The attack also produces fewer conventional phishing indicators. The Microsoft login page remains legitimate, the victim enters their password on Microsoft’s website rather than on an attacker-controlled page, and the interaction resembles a standard device authorization process.

This can create blind spots in SOC visibility and make the attack more difficult to identify using traditional phishing detection methods.

Kali365 SharePoint Lure

The following ANY.RUN sandbox session shows an example of a Kali365 phishing page using a SharePoint-themed lure:

View analysis session and gather IOCs

Microsoft Device Login Flow

After interacting with the lure, the victim is directed to Microsoft’s legitimate device login page, where they enter the attacker-provided code and complete the authentication process.

*Redirection to Microsoft’s legitimate device login page analyzed insideANY.RUN sandbox*

Kali365 Telemetry: US Targeting and Industry Exposure

According to ANY.RUN telemetry, the United States is the primary geographic target of Kali365. More than 80 public sessions linked to the phishkit are recorded in the ANY.RUN public sandbox each week, indicating a sustained focus on US organizations and Microsoft 365 users.

Kali365 activity spans a broad range of industries, with the strongest signals observed across MSSPs, manufacturing, technology, government and public administration, healthcare, and consulting.

Kali365 activity targeting the US and industries can be explored in ANY.RUN Threat Intelligence Lookup:

TI Lookup query: threatName:”kali365″ and submissionCountry:”US”

*US industries being targeted by Kali 365*

This distribution reflects the nature of Device Code Phishing. Kali365 is not limited to a single vertical. Instead, it targets organizations that rely heavily on Microsoft 365 and cloud-based identity services, where compromised OAuth tokens may provide access to corporate email, documents, and internal SaaS resources without requiring attackers to steal the victim’s password directly.

Another notable finding is that most Kali365 phishing pages observed by ANY.RUN use the .de top-level domain.

*.de top-level domain usage exposed inside ANY.RUN’s TI Lookup*

Business Impact of Kali365 on US Organizations

For US organizations, Kali365 can turn a single device authorization request into a broader cloud security incident. Once attackers obtain OAuth access and refresh tokens, they may continue accessing Microsoft 365 resources without needing to steal or repeatedly enter the victim’s password.

This can create several business risks:

Financial loss: Compromised email accounts can support payment fraud, invoice manipulation, and business email compromise.

Operational disruption: Attackers may access or alter documents, communications, and cloud services used in daily operations.

Sensitive data exposure: Corporate email, internal files, customer information, and confidential business data may be exposed.

Higher response and recovery costs: Limited traditional phishing indicators can delay detection, expand the investigation scope, and increase containment efforts.

Compliance and legal exposure: Unauthorized access to regulated or personal data may trigger reporting obligations and further scrutiny.

Loss of trust: A compromise involving customer communications or sensitive data can damage relationships with clients, partners, and employees.

Because the victim authenticates through a legitimate Microsoft page, the activity may initially appear routine. This can give attackers more time to abuse trusted accounts, move through cloud resources, and increase the financial and operational impact before the incident is confirmed.

Inside Kali365: Lure Templates, Phishing Flows, and API Endpoints

Using ANY.RUN’s in-browser data investigation, analysts can examine encrypted Kali365 code directly inside the Interactive Sandbox. Available through the Browser Data section, this capability provides browser-level visibility into the attack and reveals content that may remain hidden from static analysis.

Check browser-level data of the attack

*In-browser data investigation revealing details of the phishing attack*

Once decrypted, the code exposes a configuration built to support multi-brand impersonation and multiple phishing flows.

The design field determines which lure page template is displayed to the victim. At the current stage of the phishkit’s development, Kali365 includes 34 templates:

#	Design	Visual lure
1	onedrive	OneDrive shared document
2	sharepoint	SharePoint shared document
3	teams	Microsoft Teams file/message
4	outlook	Outlook encrypted/protectedmessage
5	voicemail	Outlook voicemail
6	sharepoint_site	SharePoint team/site document
7	onenote	OneNote
8	dropbox	Dropbox
9	google_drive	Google Drive shared file
10	docusign	DocuSign
11	adobe	Adobe document/signature
12	ms_admin	Microsoft Admin
13	ms_security	Microsoft Security
14	ms_teams_meeting	Teams meeting
15	ms_forms	Microsoft Forms
16	ms_planner	Microsoft Planner
17	ms_calendar	Microsoft Calendar
18	ms_powerautomate	Power Automate
19	ms_sway	Microsoft Sway
20	ms_stream	Microsoft Stream
21	ms_whiteboard	Microsoft Whiteboard
22	ms_bookings	Microsoft Bookings
23	ms_intune	Microsoft Intune
24	ms_yammer	Yammer
25	ms_loop	Microsoft Loop
26	ms_copilot	Microsoft Copilot
27	ms_todo	Microsoft To Do
28	ms_onedrive_biz	OneDrive for Business
29	ms_sharepoint_news	SharePoint News
30	ms_teams_approval	Teams approval
31	ms_password_reset	Password reset
32	ms_mfa_setup	MFA setup
33	ms_quarantine	Quarantined messages
34	direct	Minimal device-code page

Explore Kali365 Lure Variants in ANY.RUN

The following sandbox sessions show how Kali365 adapts the same phishing infrastructure to different trusted brands. Analysts can compare the rendered pages, inspect browser and network activity, and review the artifacts captured during execution.

Check DocuSign-themed lure

*DocuSign-themed lure analyzed inside ANY.RUN’s sandbox*

Check OneDrive-themed lure

*OneDrive-themed lure analyzed inside ANY.RUN’s sandbox*

The code also contains a ready-made set of templates that operators can use to switch between different brands and phishing scenarios without rebuilding the underlying infrastructure.

*multiple Kali365 lure template builders in web-page source code*

Another important configuration field is flow_type, which determines which Device Code Phishing flow Kali365 uses:

flow_type	Provider	Device URL	Polling API
device_code	Microsoft	login.microsoftonline.com/common/oauth2/deviceauth	/api/status/
google	Google	google.com/device

Kali365 supports both Microsoft and Google device authorization flows. However, the Microsoft flow is used most frequently by its operators.

Device-Code Session Creation Endpoints

Kali365 uses the following endpoints to generate a device-code session and retrieve the corresponding lure configuration:

/api/generate?lure=
/api/lure-config/

Device-Code Polling Endpoints

The phishkit then uses separate polling endpoints to check the status of Microsoft and Google device-code sessions:

/api/status/
/api/google/status/

Recommendations for SOC Analysts

Kali365 investigations should go beyond the legitimate Microsoft or Google login page. Analysts need to identify the infrastructure that initiated the device-code flow and confirm whether OAuth tokens were issued or used.

Reconstruct the full phishing flow: Analyze the original URL in ANY.RUN’s Interactive Sandbox. Use in-browser data investigation to inspect encrypted scripts, redirects, runtime content, and the transition from the lure to the legitimate device login page.

*Kali365 phishing attack flow analyzed inside ANY.RUN sandbox in just 60 seconds*

Extract Kali365-specific artifacts: Review the design and flow_type fields, lure IDs, redirect chains, domains, and backend paths such as /api/generate?lure=

Investigate related campaign activity: Pivot on the extracted domains, URLs, IP addresses, and Kali365 detections in ANY.RUN Threat Intelligence Lookup to uncover connected infrastructure, submissions, hosting patterns, and targeting trends.

*Kali365-related sandbox sessions showcased inside ANY.RUN’s TI Lookup for deeper analysis*

Strengthen continuous detection: Use ANY.RUN Threat Intelligence Feeds to deliver fresh malicious domains, URLs, and IP addresses into SIEM, SOAR, and other security tools. This helps teams detect and block related phishing infrastructure beyond the initial investigation.

*Get 100% actionable IOCs right inside your existing SIEM, SOAR and other security tools*

Correlate with identity telemetry: Check for device-code authentication, unusual OAuth activity, token issuance, unexpected sign-in locations, and subsequent access to Outlook, SharePoint, OneDrive, Teams, or other cloud resources.

A password reset alone may not contain the incident. Analysts should also revoke active sessions and refresh tokens, review OAuth permissions, remove unauthorized application access, and investigate follow-on activity.

Recommendations for CISOs and Security Leaders

Kali365 shows why phishing risk can no longer be measured only by blocked emails or stolen passwords. Device Code Phishing can turn a legitimate authentication process into unauthorized cloud access, making identity visibility and token response critical parts of the security program.

Review the business need for device-code authentication: Restrict or disable the flow where it is not required, and apply conditional access controls to reduce unnecessary exposure.
Expand monitoring beyond passwords and endpoints: Ensure the SOC can detect unusual OAuth activity, token issuance, new application access, and suspicious use of Microsoft 365 resources.
Prepare for token-based compromise: Incident response plans should include session revocation, refresh-token invalidation, OAuth consent review, and investigation of mailbox, document, and SaaS activity.
Improve visibility into active phishing infrastructure: Combine ANY.RUN’s solutions to support investigation, threat hunting, and continuous detection across the security stack.
Measure response readiness: Track how quickly teams can confirm device-code abuse, identify affected accounts, revoke access, and determine whether attackers reached sensitive cloud resources.

The goal is to stop a single authorization request from developing into business email compromise, data exposure, financial fraud, or wider disruption across the organization.

Conclusion

Kali365 shows how phishing is shifting from password theft to the abuse of legitimate OAuth authentication. By using Microsoft and Google device code flows, attackers can obtain access tokens while much of the activity still appears legitimate.

Its multi-brand templates make campaigns easy to adapt and scale across different industries. For US organizations, this increases the risk of account compromise, data exposure, fraud, and delayed response.

Security teams need browser-level visibility, connected threat context, and fresh infrastructure data to identify these attacks earlier, confirm token abuse, and contain access before it develops into a wider business incident.

About ANY.RUN

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps organizations investigate threats faster andmake response decisions based on clear behavioral evidence.

Its solutions include the Interactive Sandbox for enterprise-scale malware and phishing analysis, along with Threat Intelligence products built on investigationdata from more than 15,000 organizations. This intelligence helps security teams enrich alerts, uncover active threats earlier, and add relevant context to detection, investigation, and response workflows.

ANY.RUN is SOC 2 Type II attested, demonstrating its commitment to strong security controls and customer data protection. For SOCs, MSSPs, and enterprise security teams, the platform helps reduce investigation uncertainty, accelerate triage, and turn threat analysis into actionable findings.

Related IOCs

bluefoodtruths[.]xyz
flexiscalesystems[.]de
guardedwebsolutions[.]de
proforcstaffing[.]com
reputationboosters[.]de
guardextion[.]online
prowebsitemakers[.]de
onlinebrandinghub[.]de
onsite-developments[.]net
functionalityfirst[.]de
buildyouronlineidentity[.]de
flexievolve[.]de
cloud-microsoft-drive-for-business[.]workers[.]dev
onlineidentityperfection[.]de
guardwebsolutions[.]de
securedecisionmaking[.]de
modernwebbalance[.]de
marketadaptabletech[.]de
waschmaschinenmarkt[.]de
txatvrk[.]net
hbaknoxvillecom[.]top
brandswithintegrity[.]de
turnideastoresults[.]de
wellpults[.]com
navigatingdigitalchange[.]de
qualityfirstonline[.]de
brandtrustmasters[.]de
theconsistencyfactor[.]de
reliablebusinesstech[.]de
performancereputation[.]de
dewdhurstlobl[.]com
securedecisionmakers[.]de
scalableadapt[.]de
trustinbrands[.]de

The post Kali365 Targets US Organizations with Data Theft via Device Code Phishing appeared first on ANY.RUN's Cybersecurity Blog.