Token Bingo: Don’t Let Your Code be the Winner

Arctic Wolf observed a widespread device-code phishing campaign in early April 2026 leveraging a multi-tenant PhaaS called Kali365 Live to generate realistic lures and capture Microsoft OAuth tokens or proxied session cookies (AitM). Affiliates use Cloudflare Workers to host phishing pages, share captured tokens, and access compromised Microsoft 365 mailboxes (including creating inbox rules and registering devices); key IOCs include three TCP/8443 hosts (216.203.20.95, 162.243.166.119, 199.91.220.111), a TLS certificate hash, phishing page hashes, and the kali365-live/1.0.0 user-agent, and Arctic Wolf provides recommendations to block device code flow where not required and to improve user awareness.