cyber.hendryadrian.com
Threat Research · any.run

Kali365 Uses Device-Code Phishing to Target US Organizations and Obtain OAuth Tokens

· Original article ↗

Summary

ANY.RUN reports that Kali365 targets US organizations with device-code phishing, using branded lures and legitimate Microsoft or Google login flows to obtain OAuth tokens and potentially access cloud resources.

Key points

  • Kali365 persuades victims to enter an attacker-provided device code on a legitimate Microsoft login page, avoiding a fake credential form.
  • Successful authentication can issue attackers OAuth access and refresh tokens, potentially enabling continued access to Microsoft 365 resources without the victim’s password.
  • ANY.RUN says its public sandbox records more than 80 sessions linked to the kit each week, with the United States its primary geographic target.
  • The kit supports 34 lure templates impersonating services including Microsoft 365, Google Drive, DocuSign, and Adobe; its device-code flows support Microsoft and Google, with Microsoft used most often.
  • The article identifies session-generation and polling API paths, plus related domains and other artifacts analysts can investigate.
  • Defenders are advised to monitor device-code authentication and unusual OAuth activity, and to revoke sessions and refresh tokens, review OAuth permissions, and investigate follow-on access if compromise is suspected.

Article Details

Attack Vectors
  • Kali365 uses device-code phishing: victims are lured to enter an attacker-provided code on a legitimate Microsoft or Google device-authorization page, allowing attackers to obtain OAuth access and refresh tokens.
  • The phishing kit uses configurable, multi-brand lure templates, including SharePoint-, OneDrive-, Teams-, Outlook-, DocuSign-, and other themed pages.
  • The article says Kali365 supports Microsoft and Google device-authorization flows, with the Microsoft flow used most frequently by its operators.
Defensive Notes
  • Investigate the original phishing URL, redirects, encrypted scripts, runtime content, lure IDs, design and flow_type fields, and related backend paths—not just the legitimate Microsoft or Google login page.
  • Correlate device-code authentication with unusual OAuth activity, token issuance, unexpected sign-in locations, new application access, and subsequent cloud-resource access.
  • Where device-code authentication is not needed, restrict or disable the flow and apply conditional-access controls.
  • For suspected compromise, revoke active sessions and refresh tokens, review OAuth permissions, remove unauthorized application access, and investigate follow-on mailbox, document, and SaaS activity; a password reset alone may not contain the incident.

Indicators of compromise

TypeIndicatorContext
DOMAINbluefoodtruths[.]xyzListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINbrandswithintegrity[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINbrandtrustmasters[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINbuildyouronlineidentity[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINcloud-microsoft-drive-for-business[.]workers[.]devListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINdewdhurstlobl[.]comListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINflexievolve[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINflexiscalesystems[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINfunctionalityfirst[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINguardedwebsolutions[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINguardextion[.]onlineListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINguardwebsolutions[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINhbaknoxvillecom[.]topListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINmarketadaptabletech[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINmodernwebbalance[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINnavigatingdigitalchange[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINonlinebrandinghub[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINonlineidentityperfection[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINonsite-developments[.]netListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINperformancereputation[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINproforcstaffing[.]comListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINprowebsitemakers[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINqualityfirstonline[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINreliablebusinesstech[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINreputationboosters[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINscalableadapt[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINsecuredecisionmakers[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINsecuredecisionmaking[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINtheconsistencyfactor[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINtrustinbrands[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINturnideastoresults[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINtxatvrk[.]netListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINwaschmaschinenmarkt[.]deListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.
DOMAINwellpults[.]comListed as a related Kali365 IOC; the article presents the list as phishing-related infrastructure.

MITRE ATT&CK

T1528 · Steal Application Access TokenKali365's device-code phishing flow obtains OAuth access and refresh tokens after victims authorize an attacker-controlled device code.

Vendors

GoogleGoogle Drive shared file MicrosoftKali365 is targeting US organizations with device code phishing attacks that abuse legitimate Microsoft authentication.

Products

Microsoft 365By obtaining OAuth access and refresh tokens, attackers may gain continued access to Microsoft 365 accounts, corporate email, documents, and cloud resources without stealing the victim’s password directly.Microsoft OneDriveonedrive Microsoft SharePointKali365 SharePoint Lure Microsoft TeamsMicrosoft Teams file/message Outlookoutlook 

Tools

Kali365Kali365 is targeting US organizations with device code phishing attacks that abuse legitimate Microsoft authentication.

Countries

United StatesAccording to ANY.RUN telemetry, the United States is the primary geographic target of Kali365.

Industries

ConsultingKali365 activity spans a broad range of industries, with the strongest signals observed across MSSPs, manufacturing, technology, government and public administration, healthcare, and consulting.Government and public administrationKali365 activity spans a broad range of industries, with the strongest signals observed across MSSPs, manufacturing, technology, government and public administration, healthcare, and consulting.HealthcareKali365 activity spans a broad range of industries, with the strongest signals observed across MSSPs, manufacturing, technology, government and public administration, healthcare, and consulting.ManufacturingKali365 activity spans a broad range of industries, with the strongest signals observed across MSSPs, manufacturing, technology, government and public administration, healthcare, and consulting.MSSPsKali365 activity spans a broad range of industries, with the strongest signals observed across MSSPs, manufacturing, technology, government and public administration, healthcare, and consulting.TechnologyKali365 activity spans a broad range of industries, with the strongest signals observed across MSSPs, manufacturing, technology, government and public administration, healthcare, and consulting.

Related Articles