Huntress Details Kali365 Phishing Kit’s Microsoft 365 Token Theft and Fraud Tools
Summary
Huntress analyzed Kali365/Octopi365, a phishing-as-a-service kit that steals Microsoft 365 tokens through device-code and AiTM attacks, then enables mailbox access, persistence, and follow-on fraud.
Key points
- Huntress traced a suspected campaign to device-code sign-ins from Tencent Cloud, observing more than 80 successful login events on May 20, 2026.
- The kit uses Microsoft sign-in lures to capture tokens; in one observed case, access was gained in as little as 42 seconds and could persist after MFA use or password changes.
- Researchers found more than 240 IPs hosting panel variants, with at least 33 lure templates and over 100 API endpoints across the platform.
- One edition supports mailbox monitoring and AI-assisted business email compromise; another scans captured mailboxes for sensitive data and can abuse Exchange administration features.
- Companion desktop tools turn stolen tokens into browser sessions and send phishing emails from compromised accounts, using paced sending and draft management.
- Huntress recommends investigating device-code activity alongside token use, mailbox access, sign-in logs, user agents, and suspicious infrastructure; it supports restricting device-code authentication where possible.
Article Details
- Attack Vectors
- Phishing emails direct recipients to a lure page and then to a legitimate Microsoft sign-in, where victims are prompted to enter a device code.
- The E1 panel captures Microsoft 365 sessions through adversary-in-the-middle reverse-proxy cookie theft and device-code-flow lures.
- Stolen access and refresh tokens are used to open victim mailboxes and establish browser sessions without an interactive sign-in.
- OctoLink Sender uses compromised accounts to send phishing emails through Microsoft Graph, including to other recipients in the victim's organization.
- The E2 edition supports follow-on business email compromise by analyzing intercepted conversations and drafting replies for operators to send from compromised mailboxes.
- Defensive Notes
- Microsoft recommends that organizations block device-code flow as broadly as possible, allowing exceptions only where there is a legitimate need.
- Investigate device-code sign-ins as possible evidence of broader token abuse, mailbox access, persistence, and follow-on activity.
- Hunt across sign-in logs, token activity, mailbox use, unusual user agents, and suspicious infrastructure. The article notes that OctoLink apps can create real browser sessions using SSO cookies rather than scripted Graph traffic.
- The article's detection guidance includes reviewing sign-ins from AS132203 or 43.173.64.0/20 and the user agent, while noting that residential proxies can complicate IP-based detection.
MITRE ATT&CK
T1078 · Valid AccountsOperators use captured tokens and resulting sessions to access victims' Microsoft accounts and services.T1090.002 · External ProxyThe article describes optional residential geo-proxying to make sign-in activity appear to originate from a victim's country.T1114.002 · Remote Email CollectionOperators read victim mailboxes through the panel's Outlook webmail proxy and scan captured mail for valuable information.T1528 · Steal Application Access TokenThe phishing flow captures Microsoft 365 access and refresh tokens from victims.T1534 · Internal SpearphishingOctoLink Sender sends phishing messages through Microsoft Graph using compromised accounts.T1539 · Steal Web Session CookieThe panel captures session cookies, and OctoLink Live obtains ESTSAUTH cookies to open victim sessions in Chromium.T1550.001 · Application Access TokenOctoLink Live and OctoLink Sender reuse captured tokens to access Microsoft services as the victim.T1557 · Adversary-in-the-MiddleThe E1 panel uses adversary-in-the-middle reverse-proxy activity to capture Microsoft 365 session cookies.T1566.002 · Spearphishing LinkPhishing emails lead victims to a lure page and then to a Microsoft sign-in and device-code prompt.T1583.001 · DomainsThe panel includes a domain marketplace that lets operators purchase domains for use in phishing lures.
People
Vendors
CloudflareLure traffic is routed through Cloudflare Workers with linked custom domains, and Cloudflare Turnstile filters out bots.MicrosoftThe attack flow is fast and effective: victims are pushed through a legitimate Microsoft login and prompted to enter a device code, giving attackers access that can persist even after MFA use or password changes.OxaPayAPI endpoints, RBAC, a full payout pipeline, self-service payments through cryptocurrency payment gateway OxaPay, and a desktop application for operators - a whole cybercrime ecosystem.
Products
Cloudflare TurnstileLure traffic is routed through Cloudflare Workers with linked custom domains, and Cloudflare Turnstile filters out bots.Cloudflare WorkersLure traffic is routed through Cloudflare Workers with linked custom domains, and Cloudflare Turnstile filters out bots.Microsoft 365 Apps for Enterpriseon Tencent, and is the base configuration of the panel: a React/Vite single-page app that captures Microsoft 365 sessions using Adversary-in-the-Middle (AiTM) reverse-proxy cookie theft and Device Code flow lures.Microsoft Exchange ServerOne edition includes AI-assisted BEC drafting, high-value email triage, credential scanning, and Exchange admin abuse to turn stolen access into monetizable outcomes.Microsoft GraphThe app grabs victim tokens from the panel, re-activates them with a new Microsoft refresh token, and sends mail as the victim through Microsoft Graph.
Tools
Freedom365Kali365, Octopi365, and Freedom365 are related names for the same Phishing-as-a-Service platform, likely stemming from rebranding, kit theft, or other operator activities.Kali365HomeBlogHook, Line, and Token: Anatomy of the Kali365 / Octopi365 Phishing-as-a-Service KitKali365 LiveOctoLink Live (also known as Kali365 Live) is the desktop app operators run next to the phishing panel.OctoLink LiveThe companion desktop apps, such as OctoLink Live and OctoLink Sender, make the threat harder to catch because they convert stolen tokens into real browser sessions and controlled outbound phishing activity that canOctoLink SenderThe companion desktop apps, such as OctoLink Live and OctoLink Sender, make the threat harder to catch because they convert stolen tokens into real browser sessions and controlled outbound phishing activity that canOctopi365HomeBlogHook, Line, and Token: Anatomy of the Kali365 / Octopi365 Phishing-as-a-Service KitValidinUsing Validin, we were able to find over 150 IP addresses hosting several variants of this phishing kit panel.