Kali365

“Once obtained, the tokens allow attackers to access Microsoft 365 services, maintain persistent access through refresh tokens, and conduct follow-on activities such as further reconnaissance, phishing, and data extraction.”

The platform also offers a tool known as OctoLink Sender to mass-send phishing emails from the breached account to other contacts, a technique called lateral phishing.

Victims are persuaded to enter an attacker-provided device code and complete authentication, unknowingly authorizing an attacker-controlled application or session.

A phishing kit known as Kali365 is targeting U.S. organizations through device code phishing attacks that abuse Microsoft’s legitimate authentication process to hijack Microsoft 365 accounts.

In a typical attack executed in ANY.RUN Sandbox, the victim receives a phishing message containing a lure, often themed around SharePoint or a document-sharing request.

When a recipient clicks the embedded link, they typically land on a fake document portal hosted on compromised domains such as testserveren[.]com or barifurniture[.]net.

Victims are persuaded to enter an attacker-provided device code and complete authentication, unknowingly authorizing an attacker-controlled application or session.

It also includes an Exchange Admin module that uses captured admin tokens to create rogue mail connectors, change mail-flow rules, and toggle DKIM signing for each accepted domain.

Victims are persuaded to enter an attacker-provided device code and complete authentication, unknowingly authorizing an attacker-controlled application or session.

It also includes an Exchange Admin module that uses captured admin tokens to create rogue mail connectors, change mail-flow rules, and toggle DKIM signing for each accepted domain.

Victims are persuaded to enter an attacker-provided device code and complete authentication, unknowingly authorizing an attacker-controlled application or session.

By inserting themselves directly into legitimate sign-in workflows, attackers can capture session cookies, authentication tokens, and multi-factor authentication (MFA)-protected access in real time...

The technique allows threat actors to obtain OAuth access tokens and refresh tokens, potentially giving them persistent access to corporate email, SharePoint files, OneDrive data, and other cloud-connected services.

Since attackers are harvesting session cookies and tokens, they inherit fully authenticated identities inside Microsoft 365 rather than simply stealing passwords.

AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine... Agent Tesla has the ability to extract credentials from configuration or support files... APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

At the core of this operation is adversary in the middle phishing that turns Outlook itself into a trusted relay for Microsoft 365 session theft.

Once authentication is approved, the attacker receives OAuth tokens connected to the device code flow. Access tokens enable temporary access to approved resources, while refresh tokens may allow attackers to request new access tokens and maintain access over time.

It also includes an Exchange Admin module that uses captured admin tokens to create rogue mail connectors, change mail-flow rules, and toggle DKIM signing for each accepted domain. It can also list tenant mailboxes using Graph.

By inserting themselves directly into legitimate sign-in workflows, attackers can capture session cookies, authentication tokens, and multi-factor authentication (MFA)-protected access in real time...

The Token Vault. Every row is a live M365 session the operator can act on right now... The INBOX and EXPORT buttons on the right do exactly what they say.

“Once obtained, the tokens allow attackers to access Microsoft 365 services, maintain persistent access through refresh tokens, and conduct follow-on activities such as further reconnaissance, phishing, and data extraction.”

At the core of this operation is adversary in the middle phishing that turns Outlook itself into a trusted relay for Microsoft 365 session theft.

Behind the scenes, reverse proxy based kits such as EvilProxy, FlowerStorm, and Kali365 relay the credentials to the real Microsoft service while capturing the live session cookies.

A successful compromise can expose email communications, internal documents, cloud resources, customer information, and connected SaaS applications.

Compromised Microsoft 365 accounts may be used for business email compromise, invoice fraud, payment diversion, data theft, and internal spear-phishing.