Kali365 Activity Surges: Device Code Phishing Is Scaling Fast

There’s an increase in Device Code phishing activity, with Kali365 emerging as one of the most active PhaaS. In the last 24 hours alone, ANYRUN recorded 100+ related analysis sessions.

The attack abuses legitimate Microsoft device authentication flows. Victims are shown a user code and instructed to enter it into a real Microsoft device auth page, allowing attackers to capture OAuth access tokens instead of passwords. The risk shifts from credential theft to token abuse, while significantly reducing the number of traditional phishing indicators typically used for detection and triage.

Deobfuscated Kali365 JavaScript revealed that after a verification gate, the lure deploys a phishing page, launches a legitimate Microsoft device authentication flow, and then polls /api/status/<session\_id> for session states such as captured, expired, and declined.

The code also contains lure-template generators for OneDrive, SharePoint, Teams, Outlook, and Voicemail, and a separate Google device-code authentication flow.

Analysis and IOCs: https://app.any.run/tasks/d078f430-c3cc-44e8-a809-5506205049c3

https://preview.redd.it/qve9gy4y9q3h1.png?width=1080&format=png&auto=webp&s=a5058a4553a38d8e012cc9f51a37b7efa5ae5fc9

Impact

The primary impact is unauthorized access through stolen OAuth access tokens, which can be abused to access victim accounts and services without needing passwords. This token theft bypasses traditional credential theft detection methods, increasing the risk of account compromise and potential data exposure. The phishing campaign targets users of Microsoft and Google services, potentially affecting a broad user base. There are no known software vulnerabilities exploited, and no direct patches apply since this is a social engineering attack.

Defensive guidance

No official patches or fixes apply as this is a phishing campaign exploiting legitimate authentication flows. Defenders should educate users about the risks of entering device codes on unsolicited prompts and implement multi-factor authentication methods that do not rely solely on OAuth tokens. Monitoring for unusual OAuth token usage and employing conditional access policies can help mitigate token abuse. Since traditional phishing indicators are reduced, enhanced user awareness and behavioral detection are critical. Check vendor advisories for any updated guidance on device code phishing mitigation.

Summary

Kali365 is a phishing-as-a-service platform that leverages device code phishing targeting Microsoft and Google authentication flows. Instead of stealing passwords, it captures OAuth access tokens by directing victims to enter user codes on legitimate Microsoft device authentication pages. The phishing kit includes lure templates for multiple Microsoft services and polls session states to track success. This approach reduces typical phishing detection signals, complicating defense efforts. The surge in activity was documented via analysis sessions on ANYRUN, highlighting rapid scaling of this phishing technique.

Kali365 Activity Surges: Device Code Phishing Is Scaling Fast

Discussion

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 27 May 2026, 19:03 UTC

Technical details

References

Community reviews

Related threats