Kali365 PhaaS Kit: OAuth Device-Code Phishing Enables MFA-Satisfied Token Theft

Kali365 (K365) is a subscription Phishing‑as‑a‑Service sold via Telegram that uses OAuth device‑code phishing to capture long‑lived Microsoft 365 refresh tokens. The report separates three evidence streams—reverse‑engineered operator client (kali365.exe), purchased access to a legitimate web panel, and a fake/testing panel—and confirms the operator client unpacks to an Electron/TypeScript app that polls a backend (v2.duemineral.uk) for stolen tokens and offers one‑click access to Outlook/Admin Center via token injection and SSO cookie export. The service is monetized via subscriptions and bulk “lines” of stolen tokens, includes n8n-based lure orchestration, and provides numerous IOCs (domains, IPs, wallet addresses, file hashes) together with Entra ID/Azure AD and endpoint detection guidance; victim counts remain unconfirmed where sourced from the fake panel.