Kali365, a newly identified phishing kit, exploits Microsoft's device code authentication flow to compromise corporate accounts at US organizations. The attack bypasses traditional email-based phishing by leveraging legitimate Microsoft login infrastructure.
The kit operates by sending victims attacker-controlled device codes. When users authenticate through Microsoft's genuine authentication page, they unknowingly approve access for threat actors. The system then issues access and refresh tokens, granting attackers persistent entry to compromised accounts.
Once inside, attackers gain direct access to email, cloud documents, and other cloud resources stored within Microsoft's ecosystem. Refresh tokens provide long-lived credentials, meaning threat actors can maintain access even after password changes or sessions expire. This creates sustained opportunities for data theft, lateral movement within networks, and financial fraud.
The attack's sophistication lies in its use of legitimate authentication channels. Victims see real Microsoft login pages and follow normal authentication procedures. This dramatically increases credibility compared to traditional phishing emails mimicking Microsoft, bypassing many user training programs and email filters that flag obvious spoofing attempts.
Organizations using Microsoft 365 face particular risk. The device code authentication flow, designed for headless devices and applications, becomes weaponized when attackers control the codes presented to users. Victims cannot easily distinguish between legitimate device authentication requests and malicious ones without technical knowledge.
The threat extends beyond immediate account compromise. Once attackers obtain tokens, they can access shared files, collaborate on documents, and gather intelligence about organizational structure and sensitive projects. Refresh tokens mean attackers maintain access for weeks or months unless organizations explicitly revoke them.
Defenders should monitor for suspicious device code authentication attempts in Microsoft 365 logs, implement conditional access policies requiring additional verification, and educate users about the risks of approving unexpected device authentication requests. Organizations should also enforce token lifetime policies and implement aggressive timeout requirements for sensitive applications.
The emergence of Kali