Executive Summary
In early 2026, a widespread campaign dubbed 'Riding the Rails' utilized the Kali365 Live Phishing-as-a-Service (PhaaS) platform to bypass multi-factor authentication (MFA) via OAuth device code abuse. The platform, which features a multi-tenant affiliate model, allows threat actors to automate lure generation and session hijacking using Cloudflare Workers and specialized backend infrastructure. Artifacts suggest infrastructure overlap with EvilTokens and CLURE malware kits.
The attack chain involves socially engineering victims into entering device authorization codes on legitimate Microsoft login pages, resulting in the theft of OAuth access and refresh tokens. Once authenticated, attackers have been observed implementing inbox rules to suppress security alerts and registering additional devices to maintain persistence. The platform also supports an Adversary-in-the-Middle (AitM) 'Cookie Link' mode for transparent session proxying.
This campaign poses a significant risk to organizations using Microsoft 365, as the technique bypasses traditional MFA protections by leveraging legitimate identity provider flows. Impacted sectors include manufacturing, education, finance, and healthcare across North America and EMEA, highlighting the urgent need for conditional access policy refinements.