Inside Kali365, a Device Code Phishing Ecosystem

Huntress SOC researchers investigated a surge of device code authentication events from Tencent Cloud IPs and uncovered Kali365, a mature Phishing-as-a-Service (PhaaS) kit targeting Microsoft 365. The platform features three variants with 33 built-in lure templates, a token vault, AI-powered BEC modules using Claude Sonnet, an in-panel Outlook webmail proxy, a domain marketplace, RBAC, and cryptocurrency-based self-service billing via OxaPay. Two companion Electron desktop apps — OctoLink Live and OctoLink Sender — convert stolen tokens into real authenticated browser sessions and enable mass lateral phishing via Microsoft Graph, all while mimicking legitimate user behavior to evade detection. The kit maintains persistent access even after MFA enforcement or password resets by abusing refresh tokens and the Microsoft Authentication Broker client ID. Huntress recommends blocking device code flow via Conditional Access and has published IoCs and KQL hunting rules.

Nguồn: https://www.huntress.com/blog/kali365-device-code-phishing-kit. 8sync News chỉ tóm tắt và dẫn link; bản quyền nội dung thuộc tác giả và nguồn gốc.

Đề xuất cho bạn

The Next Web334 phút3 ngày trướcAITop

Nadella: we can't let AI giants eat the economy

Tổng giám đốc Microsoft Satya Nadella cảnh báo rằng các công ty AI không thể vừa dự đoán …

#ai#microsoft#openai