Kali365 Device-Code Phishing Turns an EFT Payment Lure into Microsoft 365 Token Theft

This report analyzes a Kali365 device-code phishing campaign that uses business-themed EFT/invoice lures and multi-stage redirects (legitimate SaaS hosting → phishing landing → Microsoft device-code flow) to trick victims into authorizing attacker-controlled OAuth sessions and thereby capture Microsoft 365 access tokens; it includes observed URLs, domains, an IP address, comparisons to FBI reporting, and defensive guidance such as blocking device-code flow and inspecting redirect chains.