Executive Summary
Kali365 is a sophisticated phishing kit primarily targeting US-based organizations in the MSSP, manufacturing, technology, government, and healthcare sectors. Unlike traditional phishing that steals passwords, Kali365 utilizes Device Code Phishing to trick users into authorizing attacker-controlled sessions on legitimate Microsoft and Google authentication pages. This approach allows adversaries to bypass multi-factor authentication (MFA) and gain persistent access to corporate cloud resources via OAuth tokens.
The attack chain involves the use of 34 distinct lure templates—ranging from SharePoint and OneDrive to DocuSign and Microsoft Teams—to establish credibility. Because the victim enters their credentials on a legitimate Microsoft domain, traditional security controls often fail to trigger alerts. This method significantly increases the risk of financial loss through business email compromise (BEC), sensitive data exposure, and operational disruption while complicating incident response efforts.