Cali 365 Phishing Kit Captures Microsoft 365 Tokens to Bypass MFA
· 18:01 · Watch on YouTube ↗
Summary
John Hammond examines Cali 365 and related Octo Pi 365 phishing kits, which use device-code phishing to capture Microsoft 365 OAuth tokens, bypass MFA and enable mailbox access, business email compromise and wire-fraud scams. Research indicates activity continues.
Key points
- The video says Cali 365 first appeared in April 2026 and was primarily distributed through Telegram; the FBI issued a public-service announcement about the platform in May.
- Device-code phishing uses a lure to persuade victims to sign in through legitimate Microsoft authentication. The attackers capture OAuth tokens without intercepting the victim’s credentials or MFA response.
- Tanner’s research, discussed in the video, used Valdin to find more than 150 IP addresses hosting variants of the phishing-kit panel.
- The panels include a token vault for captured Microsoft 365 accounts, which can enable operators to read inboxes and send email.
- Analysis of the OctoLink desktop applications found Electron-based apps with authentication functionality and an email sender intended to support bulk email campaigns.
- The panel reportedly uses AI to analyze email threads and draft replies, which could support business email compromise and wire-fraud scams.
- Although Telegram messages reportedly said operators were shutting down after the FBI announcement, the video says activity continued.
Article Details
- Topics
- [00:00] FBI warning and Cali 365’s emergence and distribution
- [02:14] Device-code phishing and OAuth token capture
- [03:39] Research on Cali 365 and Octo Pi 365 panels and lures
- [05:01] Token vault, inbox access, and AI-assisted email replies
- [10:01] Reverse engineering the OctoLink desktop applications
- [16:49] Reported continued activity after operators discussed shutting down
MITRE ATT&CK
T1528 · Steal Application Access TokenThe phishing kits capture victims’ Microsoft 365 OAuth access tokens through device-code phishing.T1550.001 · Application Access TokenThe captured application access tokens can let operators access victims’ Microsoft 365 accounts without their credentials or MFA.T1566.002 · Spearphishing LinkThe panels generate phishing links and lures that direct victims to device-code authentication flows.