Kali365

Victims are persuaded to enter an attacker-provided device code and complete authentication, unknowingly authorizing an attacker-controlled application or session.

“If that role includes Global Administrator, the amber Admin button appears immediately. One click. Full inbox access.”

“Victims are steered to the genuine login.microsoft.com/device page and approve an attacker-initiated device session.”

In a typical attack executed in ANY.RUN Sandbox, the victim receives a phishing message containing a lure, often themed around SharePoint or a document-sharing request.

“The operator sends a phishing message instructing the victim to enter the supplied user_code at login.microsoft.com/device.”

“The compromised account is then weaponized: the same prize-link lure is blasted out to all the victim’s contacts.”

Victims are persuaded to enter an attacker-provided device code and complete authentication, unknowingly authorizing an attacker-controlled application or session.

“If that role includes Global Administrator, the amber Admin button appears immediately. One click. Full inbox access.”

“If the victim approves the request, the intruder receives an OAuth authorization token with the permissions granted.”

Victims are persuaded to enter an attacker-provided device code and complete authentication, unknowingly authorizing an attacker-controlled application or session.

“If that role includes Global Administrator, the amber Admin button appears immediately. One click. Full inbox access.”

“If the victim approves the request, the intruder receives an OAuth authorization token with the permissions granted.”

Victims are persuaded to enter an attacker-provided device code and complete authentication, unknowingly authorizing an attacker-controlled application or session.

“If that role includes Global Administrator, the amber Admin button appears immediately. One click. Full inbox access.”

By inserting themselves directly into legitimate sign-in workflows, attackers can capture session cookies, authentication tokens, and multi-factor authentication (MFA)-protected access in real time...

The platform reportedly offers AI-generated phishing emails, automated campaign management, victim tracking dashboards, and OAuth token capture capabilities.

Since attackers are harvesting session cookies and tokens, they inherit fully authenticated identities inside Microsoft 365 rather than simply stealing passwords.

AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine... Agent Tesla has the ability to extract credentials from configuration or support files... APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

At the core of this operation is adversary in the middle phishing that turns Outlook itself into a trusted relay for Microsoft 365 session theft.

Once authentication is approved, the attacker receives OAuth tokens connected to the device code flow. Access tokens enable temporary access to approved resources, while refresh tokens may allow attackers to request new access tokens and maintain access over time.

“Long-lived refresh tokens are stored panel-side and reused weeks later” and “lets an operator open a victim’s Outlook or Admin Center in one click using stolen refresh tokens.”

By inserting themselves directly into legitimate sign-in workflows, attackers can capture session cookies, authentication tokens, and multi-factor authentication (MFA)-protected access in real time...

At the core of this operation is adversary in the middle phishing that turns Outlook itself into a trusted relay for Microsoft 365 session theft.

Behind the scenes, reverse proxy based kits such as EvilProxy, FlowerStorm, and Kali365 relay the credentials to the real Microsoft service while capturing the live session cookies.

A successful compromise can expose email communications, internal documents, cloud resources, customer information, and connected SaaS applications.

Compromised Microsoft 365 accounts may be used for business email compromise, invoice fraud, payment diversion, data theft, and internal spear-phishing.