Kali365 Targets US Organizations with Data Theft via Device Code Phishing 

Kali365 is targeting US organizations with device code phishing attacks that abuse legitimate Microsoft authentication. Instead of directing victims to a fake login form, the phishkit sends them to a real Microsoft page, where they authorize access using an attacker-controlled device code. 

This makes the attack harder for analysts to spot and more dangerous for the business. By obtaining OAuth access and refresh tokens, attackers may gain continued access to Microsoft 365 accounts, corporate email, documents, and cloud resources without stealing the victim’s password directly. 

Kali365 Attack Overview 

Kali365 is a phishing kit that uses the Device Code Phishing technique. These attacks abuse Microsoft’s legitimate device authentication process: the victim isshown a user code and persuaded to enter it on the authentic Microsoft Device Login page. 

Once the victim successfully authenticates, the attackers obtain the OAuth access and refresh tokens issued to the application or client that initiated the device code flow. 

As a result, the risk shifts from traditional credential theft to the abuse of access and refresh tokens. The attack also produces fewer conventional phishing indicators. The Microsoft login page remains legitimate, the victim enters their password on Microsoft’s website rather than on an attacker-controlled page, and the interaction resembles a standard device authorization process.

This can create blind spots in SOC visibility and make the attack more difficult to identify using traditional phishing detection methods. 

Kali365 SharePoint Lure 

The following ANY.RUN sandbox session shows an example of a Kali365 phishing page using a SharePoint-themed lure: 

View analysis session and gather IOCs 

Microsoft Device Login Flow 

After interacting with the lure, the victim is directed to Microsoft’s legitimate device login page, where they enter the attacker-provided code and complete the authentication process. 

Kali365 Telemetry: US Targeting and Industry Exposure 

According to ANY.RUN telemetry, the United States is the primary geographic target of Kali365. More than 80 public sessions linked to the phishkit are recorded in the ANY.RUN public sandbox each week, indicating a sustained focus on US organizations and Microsoft 365 users.

Kali365 activity spans a broad range of industries, with the strongest signals observed across MSSPs, manufacturing, technology, government and public administration, healthcare, and consulting.

Kali365 activity targeting the US and industries can be explored in ANY.RUN Threat Intelligence Lookup:

TI Lookup query: threatName:”kali365″ and submissionCountry:”US” 

This distribution reflects the nature of Device Code Phishing. Kali365 is not limited to a single vertical. Instead, it targets organizations that rely heavily on Microsoft 365 and cloud-based identity services, where compromised OAuth tokens may provide access to corporate email, documents, and internal SaaS resources without requiring attackers to steal the victim’s password directly. 

Another notable finding is that most Kali365 phishing pages observed by ANY.RUN use the .de top-level domain. 

Business Impact of Kali365 on US Organizations 

For US organizations, Kali365 can turn a single device authorization request into a broader cloud security incident. Once attackers obtain OAuth access and refresh tokens, they may continue accessing Microsoft 365 resources without needing to steal or repeatedly enter the victim’s password.

This can create several business risks: 

• Financial loss: Compromised email accounts can support payment fraud, invoice manipulation, and business email compromise.

• Operational disruption: Attackers may access or alter documents, communications, and cloud services used in daily operations. 

• Sensitive data exposure: Corporate email, internal files, customer information, and confidential business data may be exposed. 

• Higher response and recovery costs: Limited traditional phishing indicators can delay detection, expand the investigation scope, and increase containment efforts.

• Compliance and legal exposure: Unauthorized access to regulated or personal data may trigger reporting obligations and further scrutiny. 

• Loss of trust: A compromise involving customer communications or sensitive data can damage relationships with clients, partners, and employees.

Because the victim authenticates through a legitimate Microsoft page, the activity may initially appear routine. This can give attackers more time to abuse trusted accounts, move through cloud resources, and increase the financial and operational impact before the incident is confirmed.

Inside Kali365: Lure Templates, Phishing Flows, and API Endpoints

Using ANY.RUN’s in-browser data investigation, analysts can examine encrypted Kali365 code directly inside the Interactive Sandbox. Available through the Browser Data section, this capability provides browser-level visibility into the attack and reveals content that may remain hidden from static analysis.

Check browser-level data of the attack

Once decrypted, the code exposes a configuration built to support multi-brand impersonation and multiple phishing flows.

The design field determines which lure page template is displayed to the victim. At the current stage of the phishkit’s development, Kali365 includes 34 templates:

Explore Kali365 Lure Variants in ANY.RUN 

The following sandbox sessions show how Kali365 adapts the same phishing infrastructure to different trusted brands. Analysts can compare the rendered pages, inspect browser and network activity, and review the artifacts captured during execution.

Check DocuSign-themed lure

Check OneDrive-themed lure 

The code also contains a ready-made set of templates that operators can use to switch between different brands and phishing scenarios without rebuilding the underlying infrastructure. 

Another important configuration field is flow_type, which determines which Device Code Phishing flow Kali365 uses: 

Kali365 supports both Microsoft and Google device authorization flows. However, the Microsoft flow is used most frequently by its operators. 

Device-Code Session Creation Endpoints 

Kali365 uses the following endpoints to generate a device-code session and retrieve the corresponding lure configuration: 

• /api/generate?lure=<ID> 
• /api/lure-config/<ID> 

Device-Code Polling Endpoints 

The phishkit then uses separate polling endpoints to check the status of Microsoft and Google device-code sessions: 

• /api/status/<Number> 
• /api/google/status/<Number> 

Recommendations for SOC Analysts 

Kali365 investigations should go beyond the legitimate Microsoft or Google login page. Analysts need to identify the infrastructure that initiated the device-code flow and confirm whether OAuth tokens were issued or used. 

Reconstruct the full phishing flow: Analyze the original URL in ANY.RUN’s Interactive Sandbox. Use in-browser data investigation to inspect encrypted scripts, redirects, runtime content, and the transition from the lure to the legitimate device login page.

Extract Kali365-specific artifacts: Review the design and flow_type fields, lure IDs, redirect chains, domains, and backend paths such as /api/generate?lure=<ID> and /api/status/<Number>. These patterns may provide stronger detection signals than the Microsoft login page itself.

Investigate related campaign activity: Pivot on the extracted domains, URLs, IP addresses, and Kali365 detections in ANY.RUN Threat Intelligence Lookup to uncover connected infrastructure, submissions, hosting patterns, and targeting trends. 

Strengthen continuous detection: Use ANY.RUN Threat Intelligence Feeds to deliver fresh malicious domains, URLs, and IP addresses into SIEM, SOAR, and other security tools. This helps teams detect and block related phishing infrastructure beyond the initial investigation. 

Correlate with identity telemetry: Check for device-code authentication, unusual OAuth activity, token issuance, unexpected sign-in locations, and subsequent access to Outlook, SharePoint, OneDrive, Teams, or other cloud resources.

A password reset alone may not contain the incident. Analysts should also revoke active sessions and refresh tokens, review OAuth permissions, remove unauthorized application access, and investigate follow-on activity. 

Recommendations for CISOs and Security Leaders 

Kali365 shows why phishing risk can no longer be measured only by blocked emails or stolen passwords. Device Code Phishing can turn a legitimate authentication process into unauthorized cloud access, making identity visibility and token response critical parts of the security program. 

• Review the business need for device-code authentication: Restrict or disable the flow where it is not required, and apply conditional access controls to reduce unnecessary exposure. 
• Expand monitoring beyond passwords and endpoints: Ensure the SOC can detect unusual OAuth activity, token issuance, new application access, and suspicious use of Microsoft 365 resources. 
• Prepare for token-based compromise: Incident response plans should include session revocation, refresh-token invalidation, OAuth consent review, and investigation of mailbox, document, and SaaS activity.
• Improve visibility into active phishing infrastructure: Combine ANY.RUN’s solutions to support investigation, threat hunting, and continuous detection across the security stack.
• Measure response readiness: Track how quickly teams can confirm device-code abuse, identify affected accounts, revoke access, and determine whether attackers reached sensitive cloud resources. 

The goal is to stop a single authorization request from developing into business email compromise, data exposure, financial fraud, or wider disruption across the organization.

Conclusion 

Kali365 shows how phishing is shifting from password theft to the abuse of legitimate OAuth authentication. By using Microsoft and Google device code flows, attackers can obtain access tokens while much of the activity still appears legitimate. 

Its multi-brand templates make campaigns easy to adapt and scale across different industries. For US organizations, this increases the risk of account compromise, data exposure, fraud, and delayed response. 

Security teams need browser-level visibility, connected threat context, and fresh infrastructure data to identify these attacks earlier, confirm token abuse, and contain access before it develops into a wider business incident. 

About ANY.RUN 

ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, helps organizations investigate threats faster andmake response decisions based on clear behavioral evidence.

Its solutions include the Interactive Sandbox for enterprise-scale malware and phishing analysis, along with Threat Intelligence products built on investigationdata from more than 15,000 organizations. This intelligence helps security teams enrich alerts, uncover active threats earlier, and add relevant context to detection, investigation, and response workflows.

ANY.RUN is SOC 2 Type II attested, demonstrating its commitment to strong security controls and customer data protection. For SOCs, MSSPs, and enterprise security teams, the platform helps reduce investigation uncertainty, accelerate triage, and turn threat analysis into actionable findings.

Related IOCs 

• bluefoodtruths[.]xyz  
• flexiscalesystems[.]de  
• guardedwebsolutions[.]de  
• proforcstaffing[.]com  
• reputationboosters[.]de  
• guardextion[.]online  
• prowebsitemakers[.]de  
• onlinebrandinghub[.]de  
• onsite-developments[.]net  
• functionalityfirst[.]de  
• buildyouronlineidentity[.]de  
• flexievolve[.]de  
• cloud-microsoft-drive-for-business[.]workers[.]dev  
•  onlineidentityperfection[.]de  
• guardwebsolutions[.]de  
• securedecisionmaking[.]de  
• modernwebbalance[.]de  
• marketadaptabletech[.]de  
• waschmaschinenmarkt[.]de  
• txatvrk[.]net  
• hbaknoxvillecom[.]top  
• brandswithintegrity[.]de  
• turnideastoresults[.]de  
• wellpults[.]com  
• navigatingdigitalchange[.]de  
• qualityfirstonline[.]de  
• brandtrustmasters[.]de  
• theconsistencyfactor[.]de  
• reliablebusinesstech[.]de  
• performancereputation[.]de  
• dewdhurstlobl[.]com  
• securedecisionmakers[.]de  
• scalableadapt[.]de  
• trustinbrands[.]de