As reported by The Hacker News, a sophisticated phishing kit dubbed Kali365 is actively targeting US organizations by abusing Microsoft's native device code authentication flow — a technique that turns trust in legitimate Microsoft infrastructure into a liability for enterprise defenders.

Threat Alert: As reported by The Hacker News, a sophisticated phishing kit dubbed Kali365 is actively targeting US organizations by abusing Microsoft's native device code authentication flow — a technique that turns trust in legitimate Microsoft infrastructure into a liability for enterprise defenders.

Why This Attack Is Particularly Dangerous

What makes Kali365 so insidious is precisely what makes it difficult to detect and block: the victim is never sent to a fake login page. They authenticate on Microsoft's real servers, on Microsoft's real domain. No typosquatting. No certificate mismatch. No phishing URL to flag. The entire deception occurs in the social engineering layer — convincing a user to enter an attacker-generated device code into a legitimate Microsoft portal.

This is a textbook example of a consent phishing or device code phishing attack, a technique that security researchers have tracked under various names but which continues to evolve in sophistication and scale. The resulting access and refresh tokens give attackers persistent, authenticated access to Microsoft 365 resources — email, SharePoint, OneDrive, Teams — that can survive password resets if the token itself is not revoked.

Shield53 Perspective: Refresh tokens issued through device code flows can have lifespans of 90 days or longer depending on tenant configuration. An attacker who harvests a valid refresh token doesn't need the user's password — ever. This fundamentally changes the incident response calculus.

Who Is Most at Risk

Any organization using Microsoft 365 or Azure Active Directory (now Entra ID) is technically exposed, but the highest-risk targets are those with:

Who Is Most at Risk
Large, distributed workforces where employees routinely authenticate across multiple devices and may not scrutinize device code prompts
Help desk or IT support workflows that frequently involve device code authentication for legitimate remote assistance
Organizations without Conditional Access policies restricting device code flow usage
Financial services, legal, and healthcare sectors — high-value targets for both data exfiltration and business email compromise (BEC) follow-on attacks

The Broader Threat Landscape: AiTM Evolves

Kali365 sits within a broader category of Adversary-in-the-Middle (AiTM) and token-theft campaigns that have accelerated significantly since 2022. Microsoft's own threat intelligence has documented groups like Storm-1167 and nation-state actors using similar device code phishing techniques against government and critical infrastructure targets. What Kali365 represents is the commoditization of this technique — packaged into a kit that lowers the barrier for less sophisticated threat actors to execute what was previously a complex, manual attack chain.

The downstream consequences extend well beyond initial access. Persistent token access enables attackers to:

  • Conduct internal spear-phishing using trusted email accounts (BEC)
  • Exfiltrate sensitive documents and emails silently over extended periods
  • Pivot to connected SaaS applications via OAuth delegated permissions
  • Establish persistence through registered applications or forwarding rules

Shield53 Recommendations

Immediate Actions

  • Restrict or disable device code flow in Microsoft Entra ID via Conditional Access policies. Unless your organization has a documented operational need for this flow (e.g., IoT devices, shared terminals), block it tenant-wide using the "Block legacy authentication" or a dedicated device code policy.
  • Enable token protection (Conditional Access) — currently in preview for sign-in sessions — to bind tokens to the device on which they were issued, making stolen tokens non-transferable.
  • Audit active refresh tokens and OAuth app permissions using Microsoft Entra's Sign-in logs and Risky sign-ins blade. Filter for device code flow authentication events and investigate any anomalies in source IP, geography, or application context.
  • Deploy Microsoft Defender for Cloud Apps (MDCA) policies to alert on or block impossible travel and token replay behaviors associated with device code phishing.

User Awareness

  • Train employees to never enter a device code they did not personally initiate. This is the social engineering hinge the entire attack depends on. A single sentence in security awareness training can break the kill chain.
  • Establish a clear internal process for IT-initiated device enrollment so employees have a reference point for legitimate requests versus manipulation attempts.

Detection Engineering

  • Build SIEM detection rules for Microsoft Entra Sign-in logs where authenticationProtocol == "deviceCode" and cross-reference with user behavior baselines.
  • Alert on new OAuth app consents or inbox forwarding rule creation events within 24 hours of a device code authentication event from an unfamiliar IP.
  • Integrate UEBA (User and Entity Behavior Analytics) to flag unusual access patterns post-authentication — particularly large-volume email reads or document downloads.

The Kali365 campaign is a clear signal that attackers have moved beyond defeating MFA through credential theft alone. The new frontier is trust abuse — leveraging legitimate platform flows, real authentication pages, and valid tokens. Defenders must adapt controls accordingly, treating token lifecycle management and authentication flow restriction as first-class security controls, not afterthoughts.