ODx

ODx is a phishing-as-a-service operation associated with large-scale credential and session theft against cloud email and identity platforms, particularly Microsoft 365. It is also tracked as Storm-1167 and FlowerStorm. The service is notable for offering both adversary-in-the-middle phishing and OAuth device code phishing, reflecting a hybrid capability set that supports modern account takeover operations. ODx has been identified as one of the more prominent adversary-in-the-middle kits in criminal use and has also expanded into device code phishing, a technique that abuses the OAuth 2.0 device authorization grant flow to trick victims into authorizing attacker-controlled access to their accounts. In observed operations, ODx device code phishing leveraged Kali365, another phishing-as-a-service kit focused on device code abuse. This combination indicates an ecosystem model in which operators and affiliates reuse or integrate multiple criminal phishing services. Successful ODx-enabled intrusions can provide attackers with access tokens or authenticated sessions that enable account takeover and downstream abuse. Such access can support business email compromise, fraud, data theft, lateral movement, and follow-on post-compromise activity. The actor's tradecraft aligns with financially motivated cloud-focused phishing operations that prioritize scalable initial access and session abuse over malware-heavy intrusion chains. ODx should be understood as a criminal phishing service rather than a nation-state intrusion set. Its known aliases include Storm-1167 and FlowerStorm.