{"id":22219,"date":"2026-07-21T07:01:11","date_gmt":"2026-07-21T07:01:11","guid":{"rendered":"https:\/\/any.run\/cybersecurity-blog\/?p=22219"},"modified":"2026-07-21T08:27:46","modified_gmt":"2026-07-21T08:27:46","slug":"kali365-phishing-targeting-us","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/kali365-phishing-targeting-us\/","title":{"rendered":"Kali365 Targets\u00a0US\u00a0Organizations\u00a0with Data Theft via Device Code Phishing\u00a0"},"content":{"rendered":"\n

Kali365 is targeting US organizations with device code phishing attacks that abuse legitimate Microsoft authentication. Instead of directing victims to a fake login form, the phishkit sends them to a real Microsoft page, where they authorize access using an attacker-controlled device code. <\/p>\n\n\n\n

This makes the attack harder for analysts to spot and more dangerous for the business. By obtaining OAuth access and refresh tokens, attackers may gain continued access to Microsoft 365 accounts, corporate email, documents, and cloud resources without stealing the victim\u2019s password directly. <\/p>\n\n\n\n

Kali365 Attack Overview <\/h2>\n\n\n\n

Kali365 is a phishing kit that uses the Device Code Phishing technique. These attacks abuse Microsoft\u2019s legitimate device authentication process: the victim isshown a user code and persuaded to enter it on the authentic Microsoft Device Login page. <\/p>\n\n\n\n

Once the victim successfully authenticates, the attackers obtain the OAuth access and refresh tokens issued to the application or client that initiated the device code flow. <\/p>\n\n\n\n

As a result, the risk shifts from traditional credential theft to the abuse of access and refresh tokens. The attack also produces fewer conventional phishing indicators. The Microsoft login page remains legitimate, the victim enters their password on Microsoft\u2019s website rather than on an attacker-controlled page, and the interaction resembles a standard device authorization process.<\/p>\n\n\n\n

This can create blind spots in SOC visibility and make the attack more difficult to identify using traditional phishing detection methods. <\/p>\n\n\n\n

Kali365 SharePoint Lure <\/h3>\n\n\n\n

The following ANY.RUN sandbox session shows an example of a Kali365 phishing page using a SharePoint-themed lure: <\/p>\n\n\n\n

View analysis session and gather IOCs<\/a> <\/p>\n\n\n

\n
\"\"
Kali365 phishing page using a SharePoint-themed lure<\/em> <\/figcaption><\/figure>\n<\/div>\n\n\n

Microsoft Device Login Flow <\/h3>\n\n\n\n

After interacting with the lure, the victim is directed to Microsoft\u2019s legitimate device login page, where they enter the attacker-provided code and complete the authentication process. <\/p>\n\n\n

\n
\"\"
Redirection to Microsoft\u2019s legitimate device login page analyzed insideANY.RUN sandbox<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n

Kali365 Telemetry: US Targeting and Industry Exposure <\/h2>\n\n\n\n

According to ANY.RUN telemetry, the United States is the primary geographic target of Kali365. More than 80 public sessions linked to the phishkit are recorded in the ANY.RUN public sandbox each week, indicating a sustained focus on US organizations and Microsoft 365 users.<\/p>\n\n\n\n

Kali365 activity spans a broad range of industries, with the strongest signals observed across MSSPs, manufacturing, technology, government and public administration, healthcare, and consulting<\/strong>.<\/p>\n\n\n\n

Kali365 activity targeting the US and industries can be explored in ANY.RUN Threat Intelligence Lookup<\/a>:<\/p>\n\n\n\n

TI Lookup query: threatName:”kali365″ and submissionCountry:”US”<\/a> <\/p>\n\n\n

\n
\"\"
US industries being targeted by Kali 365<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n

This distribution reflects the nature of Device Code Phishing. Kali365 is not limited to a single vertical. Instead, it targets organizations that rely heavily on Microsoft 365 and cloud-based identity services, where compromised OAuth tokens may provide access to corporate email, documents, and internal SaaS resources without requiring attackers to steal the victim\u2019s password directly. <\/p>\n\n\n\n\n

\n\n

\nTurn threat intelligence into faster action. .<\/span>
\nSee where attacks are active and respond before risk grows. \n<\/p>\n\n\nStrengthen Your Defenses <\/a>\n<\/div>\n\n\n\n