Kali365: Device Code Phishing Kit Abusing Microsoft Authentication

Kali365 is a device code phishing kit that targets US organizations by abusing legitimate Microsoft authentication. It lures victims with pages impersonating trusted services like SharePoint or DocuSign, then redirects them to Microsoft's legitimate device login portal. Once the victim enters an attacker-provided code, attackers obtain OAuth tokens granting access to Microsoft 365 resources. The campaign is tracked by ANY.RUN with over 80 public sessions weekly, primarily targeting US entities.