Kali365 is a sophisticated phishing kit exploiting Microsoft's legitimate authentication mechanisms to compromise US enterprise organizations. The attack leverages attacker-controlled device codes that victims unknowingly approve on genuine Microsoft login pages, granting persistent access to corporate email, documents, and cloud resources through valid access and refresh tokens.
Kali365 is turning a legitimate Microsoft login into a gateway to corporate data. The phishing kit targets US organizations with attacker-controlled device codes that victims approve on Microsoft's real authentication page. Once access and refresh tokens are issued, attackers may retain access to email, documents, and cloud resources, creating a direct path to data exposure, financial fraud,
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
