Kali365 Exploits Microsoft Device Login to Access US Corporate Data

Kali365 is a Phishing-as-a-Service campaign targeting US companies that uses device-code phishing to redirect victims to Microsoft’s legitimate device login, tricking them into entering attacker-provided codes so the adversary can obtain OAuth access and refresh tokens for continued access to Microsoft 365 email and cloud resources. ANY.RUN telemetry shows sustained weekly activity across multiple industries, and the report details lure templates, observed infrastructure/IOCs, and recommendations—keeping detection feeds current, using sandboxes to reveal redirect chains, and proactive threat hunting to reduce token abuse and data exposure.