This threat involves abuse of the OAuth 2.0 Device Authorization Grant via a phishing campaign leveraging the Kali365 phishing-as-a-service platform. Attackers direct victims to Microsoft's legitimate device login interface, where users unknowingly authorize sessions controlled by the adversaries. The stolen OAuth tokens provide immediate mailbox access and enable attackers to perform post-compromise actions, including setting malicious inbox rules to hide security notifications. Kali365 supports multi-language lure generation, Cloudflare Worker-hosted phishing pages, and token sharing across affiliates, enhancing the scale and effectiveness of the campaign. The primary originating IP address identified is 216.203.20.95. This campaign targets multiple sectors and regions without specific geographic focus.

Successful exploitation results in immediate unauthorized access to victims' mailboxes via stolen OAuth tokens. Attackers can conduct post-compromise activities such as establishing malicious inbox rules that suppress security notifications, increasing dwell time and reducing the likelihood of detection. The campaign leverages legitimate Microsoft login flows, increasing the difficulty of detection and user suspicion. No known exploits in the wild beyond this campaign are reported, and no direct vulnerability in Microsoft services is indicated.

No official patch or fix is applicable as this is a phishing campaign exploiting user interaction with legitimate OAuth flows. Organizations should educate users about the risks of device code phishing and the importance of verifying authorization prompts. Monitoring for unusual mailbox rules and suspicious OAuth token usage is recommended. Since this is not a software vulnerability, patch status is not applicable. Refer to vendor advisories and security guidance from Microsoft and security providers for updated detection and prevention strategies.