Kali365 Weaponizes Microsoft Authentication Against US Companies: New Enterprise Risk
Summary: Kali365 is a device code phishing kit that abuses Microsoft's legitimate authentication flow, presenting victims with a SharePoint, OneDrive, or DocuSign lure and then redirecting them to Microsoft's real device login portal to enter an attacker-provided code. ANY.RUN telemetry records more than 80 public sessions linked to the campaign each week, with the United States as its main geographic target, and once access and refresh tokens are issued attackers may retain access to Microsoft 365 email, documents, and cloud resources.
Why it matters: The victim authenticates on Microsoft's own page, so the activity can look routine while attackers hold refresh tokens that keep working after the initial login - and Kali365 operators can rotate domains, URLs, and hosting infrastructure, so indicators from one confirmed case may quickly become outdated across the rest of the environment.
Read the original at The Hacker News ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026