As cited
Copy frozen at (site build).
threat intel
Inside Kali365, a Device Code Phishing Ecosystem | Huntress
Huntress identified Kali365, a Microsoft 365 focused phishing toolkit, that leverages device code flows to steal authentication tokens and maintain persistent access despite multi-factor authentication (MFA) or password resets. The attack chain originates from Tencent Cloud infrastructure and targets organizations relying on Microsoft cloud services. The toolkit represents an evolving threat that bypasses common account recovery mechanisms.
Why it matters: Microsoft 365 users are at immediate risk from device code phishing attacks that circumvent MFA and password resets, requiring security teams to implement detection for anomalous device code flows and token theft indicators.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Inside Kali365, a Device Code Phishing Ecosystem | Huntress
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Inside Kali365, a Device Code Phishing Ecosystem | Huntress
Huntress identified Kali365, a Microsoft 365 phishing kit that uses device code authentication to steal tokens and maintain persistence after multifactor authentication (MFA) or password resets. The campaign originated from Tencent Cloud infrastructure and represents a coordinated ecosystem designed to bypass common security controls.
Why it matters: Organizations using Microsoft 365 are at risk of account compromise and data exfiltration through device code phishing; practitioners should review authentication logs for anomalous device code flows and enforce conditional access policies to block suspicious sign-in patterns.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Inside Kali365, a Device Code Phishing Ecosystem | Huntress
Huntress identified Kali365, a Microsoft 365 phishing kit that uses device code authentication to steal tokens and maintain persistence after multifactor authentication (MFA) or password resets. The campaign originated from Tencent Cloud infrastructure and represents a coordinated ecosystem designed to bypass common security controls.
Why it matters: Organizations using Microsoft 365 are at risk of account compromise and data exfiltration through device code phishing; practitioners should review authentication logs for anomalous device code flows and enforce conditional access policies to block suspicious sign-in patterns.
- Source published
- First seen by Cybersecurity Tracker