Loading malware…
Kali365 is a commercially distributed phishing-as-a-service platform primarily targeting Microsoft 365 and Microsoft Entra ID accounts through OAuth device-code phishing. Distributed through Telegram, it combines configurable phishing templates, AI-assisted lure generation, campaign dashboards, token management, and post-compromise mailbox operations. Its campaigns have targeted U.S. organizations across financial services, insurance, government, manufacturing, healthcare, technology, and consulting.
Kali365 dynamically requests a device authorization code when a victim opens a lure and persuades the victim to enter that code on Microsoft's genuine authentication page. Completing authentication, including any required MFA, authorizes the attacker-initiated session and allows the attacker's backend to obtain access and refresh tokens. This technique does not require the victim to disclose a password to a counterfeit login page and succeeds by abusing legitimate authorization rather than cryptographically defeating MFA. Lures include shared documents, voicemail notifications, security alerts, and event registrations, with redirect chains frequently passing through legitimate cloud services.
The platform provides a token vault, mailbox reading and searching, contact extraction, outbound sending from compromised accounts, infrastructure management, and domain rotation. Its OctoLink Live desktop application uses stolen tokens to establish authenticated Chromium sessions for Microsoft cloud services. OctoLink Sender supports bulk phishing from breached accounts, enabling follow-on targeting. Kali365 has also been used to search compromised mailboxes for sensitive credential material, including API keys and cryptocurrency seed phrases.
Obfuscated scripts, Cloudflare challenges, and anti-bot controls hinder automated inspection. Refresh-token reuse supports continued account access, so password resets alone may not contain a compromise. Kali365 functions as a multi-user commercial ecosystem with reseller and role-based management capabilities rather than a single-use phishing page.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
What I discovered was that this was a fairly new PhaaS kit known as Kali365. Similar to our reporting on EvilTokens earlier this year, this phishing kit uses the device authentication code flow to trick users into letting them into environments, and keeping access even if MFA is used and passwords are changed post-compromise.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
“Once obtained, the tokens allow attackers to access Microsoft 365 services, maintain persistent access through refresh tokens, and conduct follow-on activities such as further reconnaissance, phishing, and data extraction.”
The platform also offers a tool known as OctoLink Sender to mass-send phishing emails from the breached account to other contacts, a technique called lateral phishing.
[Kali365](https://attack.mitre.org/software/S9044) has generated tailored branded phishing lures to target victims utilizing a myriad of reputable services and brands that entice users to interact with the content.(Citation: Artic Wolf Labs Kali365 Device Code April 2026)(Citation: Artic Wolf Kali365 Device Code OAuth June 2026)(Citation: FBI IC3 Alert I-052126 Kali365 May 2026)(Citation: Huntress Kali365 Device Code June 2026) [Kali365](https://attack.mitre.org/software/S9044) has also been enabled with AI such as Claude Sonnet that evaluates emails and generates tailored responses to facilitate BEC activities.(Citation: Huntress Kali365 Device Code June 2026)
Victims are persuaded to enter an attacker-provided device code and complete authentication, unknowingly authorizing an attacker-controlled application or session.
“If that role includes Global Administrator, the amber Admin button appears immediately. One click. Full inbox access.”
“Victims are steered to the genuine login.microsoft.com/device page and approve an attacker-initiated device session.”
[Kali365](https://attack.mitre.org/software/S9044) has delivered phishing emails with malicious PDF, Word, Excel, and PowerPoint attachments that direct victims to actor-controlled landing pages. (Citation: Artic Wolf Labs Kali365 Device Code April 2026)
[Kali365](https://attack.mitre.org/software/S9044) has sent bulk phishing emails containing malicious hyperlinks that direct victims to actor-controlled landing pages impersonating services including SharePoint, OneDrive, Teams, DocuSign, and Adobe Acrobat Sign. (Citation: Artic Wolf Labs Kali365 Device Code April 2026)
“The compromised account is then weaponized: the same prize-link lure is blasted out to all the victim’s contacts.”
[Kali365](https://attack.mitre.org/software/S9044) has executed JavaScript within victims' browsers through a React frontend that detects browser sessions to evade automated analysis, auto-copies actor-generated device codes to the victim's clipboard, and polls the actor's C2 infrastructure every three seconds to confirm when OAuth token capture has completed..(Citation: Artic Wolf Labs Kali365 Device Code April 2026)(Citation: Artic Wolf Kali365 Device Code OAuth June 2026)(Citation: Huntress Kali365 Device Code June 2026)
[Kali365](https://attack.mitre.org/software/S9044) has directed victims to actor-controlled phishing pages through malicious links, initiating device code authorization flows or adversary-in-the-middle session capture. (Citation: Artic Wolf Labs Kali365 Device Code April 2026)(Citation: Huntress Kali365 Device Code June 2026)
[Kali365](https://attack.mitre.org/software/S9044) has dynamically generated legitimate device codes that displays on the victims screen alongside instructions to copy and paste the device code to initiate and complete a successful authentication process.(Citation: Artic Wolf Labs Kali365 Device Code April 2026)(Citation: Artic Wolf Kali365 Device Code OAuth June 2026)(Citation: FBI IC3 Alert I-052126 Kali365 May 2026)(Citation: Huntress Kali365 Device Code June 2026)(Citation: SpyCloud Kali365 June 2026)
Victims are persuaded to enter an attacker-provided device code and complete authentication, unknowingly authorizing an attacker-controlled application or session.
“If that role includes Global Administrator, the amber Admin button appears immediately. One click. Full inbox access.”
It also includes an Exchange Admin module that uses captured admin tokens to create rogue mail connectors, change mail-flow rules, and toggle DKIM signing for each accepted domain.
“If the victim approves the request, the intruder receives an OAuth authorization token with the permissions granted.”
Victims are persuaded to enter an attacker-provided device code and complete authentication, unknowingly authorizing an attacker-controlled application or session.
“If that role includes Global Administrator, the amber Admin button appears immediately. One click. Full inbox access.”
It also includes an Exchange Admin module that uses captured admin tokens to create rogue mail connectors, change mail-flow rules, and toggle DKIM signing for each accepted domain.
“If the victim approves the request, the intruder receives an OAuth authorization token with the permissions granted.”
Victims are persuaded to enter an attacker-provided device code and complete authentication, unknowingly authorizing an attacker-controlled application or session.
“If that role includes Global Administrator, the amber Admin button appears immediately. One click. Full inbox access.”
[Kali365](https://attack.mitre.org/software/S9044) has the ability to modify email rules to delete email based notifications prior to the victim seeing them.(Citation: SpyCloud Kali365 June 2026)
Larson said that attackers can abuse that access to impersonate people, access and steal data for extortion, commit fraud and deploy malware.
By inserting themselves directly into legitimate sign-in workflows, attackers can capture session cookies, authentication tokens, and multi-factor authentication (MFA)-protected access in real time...
Also, these keys help them skip multi-factor authentication (MFA) ... and stay logged in for a long time.
[Kali365](https://attack.mitre.org/software/S9044) has obtained OAuth access and refresh tokens by deceiving victims into completing actor-initiated device authorization requests, and intercepting authentication sessions with legitimate identity providers through adversary-in-the-middle reverse proxy infrastructure. (Citation: Artic Wolf Labs Kali365 Device Code April 2026)(Citation: Artic Wolf Kali365 Device Code OAuth June 2026)(Citation: FBI IC3 Alert I-052126 Kali365 May 2026)(Citation: SpyCloud Kali365 June 2026)
[Kali365](https://attack.mitre.org/software/S9044) has captured session cookies and related session artifacts when the interacted phishing lure acts as proxy for legitimate requests with login services.(Citation: Artic Wolf Labs Kali365 Device Code April 2026)(Citation: SpyCloud Kali365 June 2026)
[Kali365](https://attack.mitre.org/software/S9044) has searched compromised mailboxes for credential material such as seed phrases and API keys.(Citation: Huntress Kali365 Device Code June 2026)
AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine... Agent Tesla has the ability to extract credentials from configuration or support files... APT33 has used a variety of publicly available tools like LaZagne to gather credentials.
[Kali365](https://attack.mitre.org/software/S9044) has created obfuscated phishing landing pages that act as an adversary in the middle infrastructure that intercepts communications between the victim host and legitimate services to steal credentials and user sessions.(Citation: Artic Wolf Labs Kali365 Device Code April 2026)(Citation: Artic Wolf Kali365 Device Code OAuth June 2026)(Citation: SpyCloud Kali365 June 2026)
MAX Messenger’s backend sends a real one-time login code to the victim’s device via SMS or in-app push. Next, the victim re-enters that code into the phishing page... The kit next prompts the victim for a 2FA password, if this is enabled on the account.
Once authentication is approved, the attacker receives OAuth tokens connected to the device code flow. Access tokens enable temporary access to approved resources, while refresh tokens may allow attackers to request new access tokens and maintain access over time.
[Kali365](https://attack.mitre.org/software/S9044) has leveraged an Exchange Admin module that utilizes Graph to enumerate mailboxes in victim environments.(Citation: Huntress Kali365 Device Code June 2026)
It also includes an Exchange Admin module that uses captured admin tokens to create rogue mail connectors, change mail-flow rules, and toggle DKIM signing for each accepted domain. It can also list tenant mailboxes using Graph.
[Kali365](https://attack.mitre.org/software/S9044) has utilized an Exchange Admin module that captured admin tokens to create rogue mailbox connectors and change mail-flow rules.(Citation: Huntress Kali365 Device Code June 2026)
By inserting themselves directly into legitimate sign-in workflows, attackers can capture session cookies, authentication tokens, and multi-factor authentication (MFA)-protected access in real time...
The Token Vault. Every row is a live M365 session the operator can act on right now... The INBOX and EXPORT buttons on the right do exactly what they say.
[Kali365](https://attack.mitre.org/software/S9044) has gathered browser session information and allows affiliate threat actors to replay stolen browser sessions within their own environment.(Citation: Artic Wolf Labs Kali365 Device Code April 2026)
“Once obtained, the tokens allow attackers to access Microsoft 365 services, maintain persistent access through refresh tokens, and conduct follow-on activities such as further reconnaissance, phishing, and data extraction.”
[Kali365](https://attack.mitre.org/software/S9044) has created obfuscated phishing landing pages that act as an adversary in the middle infrastructure that intercepts communications between the victim host and legitimate services to steal credentials and user sessions.(Citation: Artic Wolf Labs Kali365 Device Code April 2026)(Citation: Artic Wolf Kali365 Device Code OAuth June 2026)(Citation: SpyCloud Kali365 June 2026)
Researchers at the company were able to identify the platform's live command-and-control (C2) infrastructure and from there identify a cluster of 126 malicious hosts that were active between early and late May, all serving the same kit.
[Kali365](https://attack.mitre.org/software/S9044)'s desktop client has made Microsoft Graph API calls using the distinct User-Agent string `kali365-live/1.0.0` to access victim mailboxes and enumerate account data following OAuth token capture.(Citation: Artic Wolf Labs Kali365 Device Code April 2026)
[Kali365](https://attack.mitre.org/software/S9044) has leveraged Cloudflare workers as reverse proxy infrastructure.(Citation: Artic Wolf Labs Kali365 Device Code April 2026)(Citation: Huntress Kali365 Device Code June 2026)(Citation: SpyCloud Kali365 June 2026)
[Kali365](https://attack.mitre.org/software/S9044) has used Cloudflare Workers to redirect traffic and to host malicious phishing pages.(Citation: Artic Wolf Labs Kali365 Device Code April 2026)(Citation: Artic Wolf Kali365 Device Code OAuth June 2026)(Citation: SpyCloud Kali365 June 2026) [Kali365](https://attack.mitre.org/software/S9044) has also leveraged Telegram chat to facilitate administrative tasks for the panel across affiliate users.(Citation: Artic Wolf Labs Kali365 Device Code April 2026)(Citation: FBI IC3 Alert I-052126 Kali365 May 2026)(Citation: SpyCloud Kali365 June 2026)
A successful compromise can expose email communications, internal documents, cloud resources, customer information, and connected SaaS applications.
Compromised Microsoft 365 accounts may be used for business email compromise, invoice fraud, payment diversion, data theft, and internal spear-phishing.
236 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.