The **Kali365** phishing kit represents a notable evolution in credential harvesting, circumventing traditional email filtering by abusing **Microsoft's** own authentication mechanisms. Telemetry from **ANY.RUN** indicates over 80 public sessions linked to this campaign weekly, with the United States being the primary target. ### How Kali365 Targets US Organizations **Kali365** operates by tricking victims into approving attacker-controlled device codes on **Microsoft's** genuine login page. A typical attack unfolds in three stages: 1. **Lure:** Victims receive a phishing email or message, often impersonating trusted services like **SharePoint**, **OneDrive**, or **DocuSign**, designed to initiate the authentication process. 2. **Microsoft Authentication:** The victim is redirected to **Microsoft's** legitimate device login portal and prompted to enter a code provided by the attacker. 3. **OAuth Access:** Upon successful authentication, attackers acquire access and refresh tokens, granting persistent access to **Microsoft 365** email, documents, and other cloud resources.  ### Business Impact of a Kali365 Compromise A single successful **Kali365** compromise can have cascading effects, leading to significant business consequences, particularly for U.S. companies: * **Financial Fraud:** Compromised email accounts can be leveraged for invoice manipulation, payment redirection, and business email compromise (BEC) scams. * **Sensitive Data Exposure:** Attackers gain access to critical corporate data, including emails, internal files, customer information, and confidential documents. * **Operational Disruption:** Unauthorized access to cloud services can disrupt daily communications and essential business processes. * **Increased Response Costs:** The subtle nature of device code phishing, where authentication occurs on a legitimate page, can delay detection and complicate incident response, leading to higher costs. * **Compliance and Reputational Risk:** Exposure of regulated or customer data can trigger mandatory reporting obligations and severely damage organizational trust and reputation. ### Three Priorities for Reducing Kali365 Risk Addressing **Kali365** requires a multi-faceted approach beyond traditional email filtering, focusing on proactive intelligence, rapid validation, and adaptive defenses. #### 1. Expand Detection with Actionable Phishing Intelligence **Kali365** operators frequently rotate domains, URLs, and hosting infrastructure. Current, dynamic threat intelligence is crucial to keep security controls effective. Fresh phishing Indicators of Compromise (IOCs) should be integrated into SIEM, SOAR, and TIP systems to enhance alert enrichment, support retrospective searches, and inform blocking decisions.  Platforms like **ANY.RUN's Threat Intelligence Feeds** provide newly observed indicators via STIX/TAXII, API, and SDK, drawn from investigations across thousands of organizations and security professionals. Each IOC is linked back to its originating session, offering full context for verification and identifying related **Kali365** infrastructure. #### 2. Empower Tier 1 with Evidence to Act on Kali365 Because victims authenticate on **Microsoft's** legitimate device login page, **Kali365** activity may initially appear innocuous. Early warning signs, however, are present in the lure, redirects, browser behavior, scripts, and attacker-controlled infrastructure. Interactive sandboxes, such as **ANY.RUN's**, allow for hands-on interaction combined with automated analysis to quickly reveal the entire attack chain—from phishing page and redirection paths to network activity and the transition into **Microsoft's** authentication flow.  Auto-generated reports consolidate verdicts, IOCs, TTPs, and behavioral evidence into shareable formats. This empowers Tier 1 analysts to confirm malicious activity sooner, streamline complex case handoffs, and facilitate faster containment before access propagates across **Microsoft 365** environments. #### 3. Translate Threat Research into Proactive Defense Beyond individual alerts, security teams can proactively explore **Kali365** activity using threat intelligence lookup tools. These provide context on related infrastructure, relevant sandbox sessions, lure screenshots, and targeting patterns. For instance, querying for `threatName:"kali365" AND submissionCountry:"US"` can reveal U.S.-focused activity.  Such research reveals **Kali365** activity across diverse sectors including **manufacturing**, **technology**, **healthcare**, **government**, **consulting**, and **MSSPs**. This granular view helps defenders understand where the campaign is active and identify connected domains, URLs, and infrastructure for enhanced proactive defense strategies.