Kali365 Targets US Organizations with Data Theft via Device Code Phishing 

Kali365 is an active phishing kit leveraging Device Code Phishing to trick victims into approving attacker-provided device codes on legitimate Microsoft (and sometimes Google) device login pages; successful flows yield OAuth access and refresh tokens that enable persistent access to Microsoft 365 resources without stealing passwords. ANY.RUN telemetry shows sustained U.S. targeting across multiple industries, numerous multi-brand lure templates, specific API endpoints (/api/generate, /api/status), and a long list of domains used as infrastructure; recommended actions include token/session revocation, OAuth consent review, expanded monitoring for token-based abuse, and domain/URL IOC blocking.