Kali365 Phishing Kit Exploits Microsoft Device Code Flow to Target US Enterprises
Kali365, a device code phishing kit, is actively targeting US organizations by abusing Microsoft's legitimate authentication flow. According to ANY.RUN telemetry, the…
Tag: device code phishing
Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens
The commercial phishing-as-a-service (PhaaS) toolkit known as Greatness has expanded its capabilities to include device code phishing, a technique that abuses the…
Greatness PhaaS Toolkit Expands with Device Code Phishing
Greatness is a commercial phishing-as-a-service (PhaaS) toolkit that has evolved to include device code phishing, AiTM token theft, and OAuth consent abuse.…
Tycoon2FA: Adding Device Code Phishing to Its Arsenal
Tycoon2FA is a well-known AiTM phishing kit that added device code phishing support in May 2026. It was previously tracked as the…
Device Code Phishing: The Fastest-Growing Threat of 2026 and How to Defend Against It
Device code phishing, which abuses the OAuth 2.0 device authorization grant to steal access tokens, has rapidly evolved from a niche technique…
Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft
A new phishing-as-a-service (PhaaS) operation called Forg365 is targeting Microsoft 365 accounts using device code phishing, adversary-in-the-middle (AitM) tactics, antibot evasion, AI-assisted…
Forg365 PhaaS Kit Targets Microsoft 365
Forg365 is a phishing-as-a-service (PhaaS) operation that uses device code phishing, AitM tactics, and AI-assisted lures to compromise Microsoft 365 accounts. It…
DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts
A sophisticated device code phishing campaign targeting Microsoft 365 accounts has been observed between late June and early July 2026, leveraging collaboration-themed…
Storm-2372: Nation-State Actor Pioneering Device Code Phishing
Storm-2372 is a nation-state threat actor that was among the first to use device code phishing in the wild, starting in 2024.…
DEBULL: Phishing-as-a-Service Platform for Device Code Attacks
DEBULL is a reusable tooling layer that packages Storm-2372-style identity tradecraft into a PhaaS platform. It provides campaign-facing and operator-facing infrastructure, using…