Kali365 Targets US Organizations with Data Theft via Device Code Phishing

interactive malware analysis Kali365 is targeting US organizations with device code phishing attacks that abuse legitimate Microsoft authentication. Instead of directing victims to a fake login form, the phishkit sends them to a real Microsoft page, where they authorize access using an attacker-controlled device code. This makes the attack harder for analysts to spot and more dangerous for the business. By obtaining OAuth access and refresh tokens, attackers may gain continued access to Microsoft 365 accounts, corporate email, documents, and cloud resources without stealing the victim’s password directly. Kali365 Attack Overview Kali365 is a phishing kit that uses the Device Code Phishing technique. These attacks abuse Microsoft’s legitimate device authentication process: the victim isshown a user code and persuaded to enter it on the authentic Microsoft Device Login page. Once the victim successfully authenticates, the attackers obtain the OAuth access and refresh tokens issued to the application or client that initiated the device code flow. As a result, the risk shifts from traditional credential theft to the abuse of access and refresh tokens. The attack also produces fewer conventional phishing indicators. The Microsoft login page remains legitimate, the victim enters their password on Microsoft’s website rather than on an attacker-controlled page, and the interaction resembles a standard device authorization process. This can create blind spots in SOC visibility and make the attack more difficult to identify using traditional phishing detection methods. The following ANY.RUN sandbox session shows an example of a Kali365 phishing page using a SharePoint-themed lure: Kali365 phishing page using a SharePoint-themed lureMicrosoft Device Login Flow After interacting with the lure, the victim is directed to Microsoft’s legitimate device login page, where they enter the attacker-provided code and complete the authentication process. Redirection to Microsoft’s legitimate device login page analyzed inside ANY.RUN sandbox Kali365 Telemetry: US Targeting and Industry Exposure According to ANY.RUN telemetry, the United States is the primary geographic target of Kali365. More than 80 public sessions linked to the phishkit are recorded in the ANY.RUN public sandbox each week, indicating a sustained focus on US organizations and Microsoft 365 users. Kali365 activity spans a broad range of industries, with the strongest signals observed across MSSPs, manufacturing, technology, government and public administration, healthcare, and consulting. Kali365 activity targeting the US and industries can be explored in ANY.RUN Threat Intelligence Lookup: US industries being targeted by Kali 365This distribution reflects the nature of Device Code Phishing. Kali365 is not limited to a single vertical. Instead, it targets organizations that rely heavily on Microsoft 365 and cloud-based identity services, where compromised OAuth tokens may provide access to corporate email, documents, and internal SaaS resources without requiring attackers to steal the victim’s password directly. Another notable finding is that most Kali365 phishing pages observed by ANY.RUN use the .de top-level domain..de top-level domain usage exposed inside ANY.RUN’s TI Lookup Business Impact of Kali365 on US Organizations For US organizations, Kali365 can turn a single device authorization request into a broader cloud security incident. Once attackers obtain OAuth access and refresh tokens, they may continue accessing Microsoft 365 resources without needing to steal or repeatedly enter the victim’s password. This can create several business risks: Financial loss: Compromised email accounts can support payment fraud, invoice manipulation, and business email compromise. Operational disruption: Attackers may access or alter documents, communications, and cloud services used in daily operations. Sensitive data exposure: Corporate email, internal files, customer information, and confidential business data may be exposed. Higher response and recovery costs: Limited traditional phishing indicators can delay detection, expand the investigation scope, and increase containment efforts. Compliance and legal exposure: Unauthorized access to regulated or personal data may trigger reporting obligations and further scrutiny. Loss of trust: A compromise involving customer communications or sensitive data can damage relationships with clients, partners, and employees. Because the victim authenticates through a legitimate Microsoft page, the activity may initially appear routine. This can give attackers more time to abuse trusted accounts, move through cloud resources, and increase the financial and operational impact before the incident is confirmed. Inside Kali365: Lure Templates, Phishing Flows, and API Endpoints Using ANY.RUN’s in-browser data investigation, analysts can examine encrypted Kali365 code directly inside the Interactive Sandbox. Available through the Browser Data section, this capability provides browser-level visibility into the attack and reveals content that may remain hidden from static analysis. In-browser data investigation revealing details of the phishing attackOnce decrypted, the code exposes a configuration built to support multi-brand impersonation and multiple phishing flows. Kali365 JS configuration The design field determines which lure page template is displayed to the victim. At the current stage of the phishkit’s development, Kali365 includes 34 templates: # Design Visual lure 1 onedrive OneDrive shared document 2 sharepoint SharePoint shared document 3 teams Microsoft Teams file/message 4 outlook Outlook encrypted/protectedmessage 5 voicemail Outlook voicemail 6 sharepoint_site SharePoint team/site document 7 onenote OneNote 8 dropbox Dropbox 9 google_drive Google Drive shared file 10 docusign DocuSign 11 adobe Adobe document/signature 12 ms_admin Microsoft Admin 13 ms_security Microsoft Security 14 ms_teams_meeting Teams meeting 15 ms_forms Microsoft Forms 16 ms_planner Microsoft Planner 17 ms_calendar Microsoft Calendar 18 ms_powerautomate Power Automate 19 ms_sway Microsoft Sway 20 ms_stream Microsoft Stream 21 ms_whiteboard Microsoft Whiteboard 22 ms_bookings Microsoft Bookings 23 ms_intune Microsoft Intune 24 ms_yammer Yammer 25 ms_loop Microsoft Loop 26 ms_copilot Microsoft Copilot 27 ms_todo Microsoft To Do 28 ms_onedrive_biz OneDrive for Business 29 ms_sharepoint_news SharePoint News 30 ms_teams_approval Teams approval 31 ms_password_reset Password reset 32 ms_mfa_setup MFA setup 33 ms_quarantine Quarantined messages 34 direct Minimal device-code page Explore Kali365 Lure Variants in ANY.RUN The following sandbox sessions show how Kali365 adapts the same phishing infrastructure to different trusted brands. Analysts can compare the rendered pages, inspect browser and network activity, and review the artifacts captured during execution. DocuSign-themed lure analyzed inside ANY.RUN’s sandbox OneDrive-themed lure analyzed inside ANY.RUN’s sandbox The code also contains a ready-made set of templates that operators can use to switch between different brands and phishing scenarios without rebuilding the underlying infrastructure. multiple Kali365 lure template builders in web-page source code Another important configuration field is flow_type, which determines which Device Code Phishing flow Kali365 uses: flow_type Provider Device URL Polling API device_code Microsoft login.microsoftonline.com/common/oauth2/deviceauth /api/status/ google Google google.com/device Kali365 supports both Microsoft and Google device authorization flows. However, the Microsoft flow is used most frequently by its operators. Device-Code Session Creation Endpoints Kali365 uses the following endpoints to generate a device-code session and retrieve the corresponding lure configuration: /api/generate?lure= /api/lure-config/ Device-Code Polling Endpoints The phishkit then uses separate polling endpoints to check the status of Microsoft and Google device-code sessions: /api/status/ /api/google/status/ Recommendations for SOC Analysts Kali365 investigations should go beyond the legitimate Microsoft or Google login page. Analysts need to identify the infrastructure that initiated the device-code flow and confirm whether OAuth tokens were issued or used. Reconstruct the full phishing flow: Analyze the original URL in ANY.RUN’s Interactive Sandbox. Use in-browser data investigation to inspect encrypted scripts, redirects, runtime content, and the transition from the lure to the legitimate device login page. Kali365 phishing attack flow analyzed inside ANY.RUN sandbox in just 60 seconds Extract Kali365-specific artifacts: Review the design and flow_type fields, lure IDs, redirect chains, domains, and backend paths such as /api/generate?lure= and /api/status/. These patterns may provide stronger detection signals than the Microsoft login page itself. Investigate related campaign activity: Pivot on the extracted domains, URLs, IP addresses, and Kali365 detections in ANY.RUN Threat Intelligence Lookup to uncover connected infrastructure, submissions, hosting patterns, and targeting trends.Kali365-related sandbox sessions showcased inside ANY.RUN’s TI Lookup for deeper analysis Strengthen continuous detection: Use ANY.RUN Threat Intelligence Feeds to deliver fresh malicious domains, URLs, and IP addresses into SIEM, SOAR, and other security tools. This helps teams detect and bloezck related phishing infrastructure beyond the initial investigation. Get 100% actionable IOCs right inside your existing SIEM, SOAR and other security tools Correlate with identity telemetry: Check for device-code authentication, unusual OAuth activity, token issuance, unexpected sign-in locations, and subsequent access to Outlook, SharePoint, OneDrive, Teams, or other cloud resources. A password reset alone may not contain the incident. Analysts should also revoke active sessions and refresh tokens, review OAuth permissions, remove unauthorized application access, and investigate follow-on activity. Recommendations for CISOs and Security Leaders Kali365 shows why phishing risk can no longer be measured only by blocked emails or stolen passwords. Device Code Phishing can turn a legitimate authentication process into unauthorized cloud access, making identity visibility and token response critical parts of the security program. Review the business need for device-code authentication: Restrict or disable the flow where it is not required, and apply conditional access controls to reduce unnecessary exposure. Expand monitoring beyond passwords and endpoints: Ensure the SOC can detect unusual OAuth activity, token issuance, new application access, and suspicious use of Microsoft 365 resources. Prepare for token-based compromise: Incident response plans should include session revocation, refresh-token invalidation, OAuth consent review, and investigation of mailbox, document, and SaaS activity. Improve visibility into active phishing infrastructure: Combine ANY.RUN’s solutions to support investigation, threat hunting, and continuous detection across the security stack. Measure response readiness: Track how quickly teams can confirm device-code abuse, identify affected accounts, revoke access, and determine whether attackers reached sensitive cloud resources. The goal is to stop a single authorization request from developing into business email compromise, data exposure, financial fraud, or wider disruption across the organization. Conclusion Kali365 shows how phishing is shifting from password theft to the abuse of legitimate OAuth authentication. By using Microsoft and Google device code flows, attackers can obtain access tokens while much of the activity still appears legitimate. Its multi-brand templates make campaigns easy to adapt and scale across different industries. For US organizations, this increases the risk of account compromise, data exposure, fraud, and delayed response. Security teams need browser-level visibility, connected threat context, and fresh infrastructure data to identify these attacks earlier, confirm token abuse, and contain access before it develops into a wider business incident. About ANY.RUN ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps organizations investigate threats faster and make response decisions based on clear behavioral evidence. Its solutions include the Interactive Sandbox for enterprise-scale malware and phishing analysis, along with Threat Intelligence products built on investigation data from more than 15,000 organizations. This intelligence helps security teams enrich alerts, uncover active threats earlier, and add relevant context to detection, investigation, and response workflows. ANY.RUN is SOC 2 Type II attested, demonstrating its commitment to strong security controls and customer data protection. For SOCs, MSSPs, and enterprise security teams, the platform helps reduce investigation uncertainty, accelerate triage, and turn threat analysis into actionable findings. bluefoodtruths[.]xyz flexiscalesystems[.]de guardedwebsolutions[.]de proforcstaffing[.]com reputationboosters[.]de guardextion[.]online prowebsitemakers[.]de onlinebrandinghub[.]de onsite-developments[.]net functionalityfirst[.]de buildyouronlineidentity[.]de flexievolve[.]de cloud-microsoft-drive-for-business[.]workers[.]dev onlineidentityperfection[.]de guardwebsolutions[.]de securedecisionmaking[.]de modernwebbalance[.]de marketadaptabletech[.]de waschmaschinenmarkt[.]de txatvrk[.]net hbaknoxvillecom[.]top brandswithintegrity[.]de turnideastoresults[.]de wellpults[.]com navigatingdigitalchange[.]de qualityfirstonline[.]de brandtrustmasters[.]de theconsistencyfactor[.]de reliablebusinesstech[.]de performancereputation[.]de dewdhurstlobl[.]com securedecisionmakers[.]de scalableadapt[.]de trustinbrands[.]de