Kali365 is a phishing-as-a-service platform that leverages device code phishing targeting Microsoft and Google authentication flows. Instead of stealing passwords, it captures OAuth access tokens by directing victims to enter user codes on legitimate Microsoft device authentication pages. The phishing kit includes lure templates for multiple Microsoft services and polls session states to track success. This approach reduces typical phishing detection signals, complicating defense efforts. The surge in activity was documented via analysis sessions on ANYRUN, highlighting rapid scaling of this phishing technique.

The primary impact is unauthorized access through stolen OAuth access tokens, which can be abused to access victim accounts and services without needing passwords. This token theft bypasses traditional credential theft detection methods, increasing the risk of account compromise and potential data exposure. The phishing campaign targets users of Microsoft and Google services, potentially affecting a broad user base. There are no known software vulnerabilities exploited, and no direct patches apply since this is a social engineering attack.

No official patches or fixes apply as this is a phishing campaign exploiting legitimate authentication flows. Defenders should educate users about the risks of entering device codes on unsolicited prompts and implement multi-factor authentication methods that do not rely solely on OAuth tokens. Monitoring for unusual OAuth token usage and employing conditional access policies can help mitigate token abuse. Since traditional phishing indicators are reduced, enhanced user awareness and behavioral detection are critical. Check vendor advisories for any updated guidance on device code phishing mitigation.