Kali365 Phishing Kit Abuses Microsoft 365 Authentication to Hijack Sessions
Summary
Barracuda researchers describe how the Kali365 phishing kit uses device-code authentication and adversary-in-the-middle attacks to obtain Microsoft 365 sessions or tokens, even when victims complete genuine sign-in and MFA.
Key points
- Kali365 phishing messages imitate routine business requests, such as document sharing, invoices, voicemail alerts, and security notifications.
- In device-code phishing, victims enter a code on a genuine Microsoft sign-in page and complete MFA, authenticating a device controlled by the attacker.
- The phishing page polls the attacker’s server for authentication success; issued tokens can then be used to access Microsoft 365 resources.
- Kali365 also supports adversary-in-the-middle attacks that capture and reuse authenticated sessions or tokens.
- With session access, attackers can reach email and files, search for financial information, create mailbox rules, forward email, and move across cloud services.
- Barracuda recommends correlating email, web, identity, and post-login activity; warning signs include unexpected device-code use, unfamiliar OAuth grants, new device registrations, and unusual resource access.
- Device-code authentication commonly directs users to Microsoft’s genuine device login page, such as microsoft[.]com/devicelogin.
Article Details
- Attack Vectors
- Kali365 campaigns use phishing emails disguised as routine business messages, such as document sharing, e-signature requests, invoices, voicemail alerts, and mailbox warnings.
- Device code phishing directs victims to authenticate through Microsoft's legitimate device login process, allowing attackers to obtain tokens linked to the device code request.
- Adversary-in-the-middle attacks proxy the Microsoft authentication process to capture and reuse authenticated sessions or tokens.
- After gaining session access, attackers may search email and files for financial information, create mailbox rules, configure forwarding, conduct business email compromise, and move laterally through cloud services.
- Defensive Notes
- Monitor unexpected device code authentication, requests to enter device verification codes, unfamiliar OAuth grants, unusual sign-in patterns, and new device registrations.
- Investigate suspicious mailbox rule creation, unexpected email forwarding, and abnormal access to SharePoint, OneDrive, Teams, or Exchange.
- Correlate signals across email, web, identity, authentication, and post-login activity rather than relying only on credential protection or website reputation checks.
MITRE ATT&CK
T1098.002 · Additional Email Delegate PermissionsSuspicious mailbox rule creation is listed as a post-authentication warning sign.T1098.007 · Additional Local or Domain GroupsThe article identifies OAuth grants to unfamiliar applications as a warning sign of these attacks.T1114 · Email CollectionAfter obtaining an authenticated session, attackers may monitor communications and search email for financial information.T1114.003 · Email Forwarding RuleAttackers may configure email forwarding after gaining access to the authenticated Microsoft 365 session.T1528 · Steal Application Access TokenDevice code phishing causes victims to authenticate an attacker-requested device, enabling the attacker to obtain authentication tokens.T1539 · Steal Web Session CookieThe article reports capture and reuse of authenticated sessions in Kali365 AiTM attacks.T1557 · Adversary-in-the-MiddleKali365 supports adversary-in-the-middle attacks in which a malicious proxy sits between the victim and Microsoft's authentication service and captures the resulting session or tokens.T1566.002 · Spearphishing LinkKali365 attacks begin with phishing emails containing links to malicious landing pages.
Vendors
Products
Microsoft 365 Apps for EnterpriseSince early 2026, Kali365, a phishing-as-a-service (PhaaS) platform targeting Microsoft 365 environments, has abused authentication processes in waves of attacks.Microsoft Exchange ServerAbnormal access to SharePoint, OneDrive, Teams, or Exchange resources.Microsoft OneDriveAbnormal access to SharePoint, OneDrive, Teams, or Exchange resources.Microsoft SharePointAbnormal access to SharePoint, OneDrive, Teams, or Exchange resources.TeamsFor security teams, the authentication logs may initially appear legitimate, and traditional website reputation checks don’t raise any red flags.