Kali365 PhaaS Kit: OAuth Device-Code Phishing Enables MFA-Satisfied Token Theft

Kali365 (K365) is a commercially sold Phishing‑as‑a‑Service platform (marketed via Telegram) that weaponizes OAuth device‑code flows to capture long‑lived Microsoft 365 refresh tokens; the report presents direct reverse engineering of an operator Electron client, purchased access to a production web panel, a separate fake/testing demo panel (excluded from victim counts), detailed token‑abuse techniques (hidden BrowserWindow seeding → MSAL intercept + bearer injection → SSO cookie export), priority IOCs (domains, wallets, IPs, file hashes), payment/monetization analysis, and actionable detection guidance for Entra ID, network, and endpoint hunting.