Kali365 is a phishing kit that abuses Microsoft’s real “device code” sign-in flow to trick employees into approving attacker-controlled login codes. Once a victim completes authentication on Microsoft’s legitimate page, attackers can receive access and refresh tokens that may grant ongoing access to Microsoft 365 email, files, and cloud resources.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: you help an attacker log in to Microsoft 365… on Microsoft’s real website. Kali365 does this with a fake SharePoint or DocuSign page that says, “View document,” then sends you to Microsoft’s device login and tells you to enter a code they provide. Here’s the catch: you’re on a real Microsoft page, but it’s not your sign-in. When you enter their code and approve, you hand over access tokens to your email, OneDrive, and SharePoint. If a SharePoint, OneDrive, or DocuSign link ever tells you to enter a device code you didn’t start, stop, close it, and report it to security right away.
Researchers observed a real phishing campaign (“CSuite”) heavily targeting U.S. organizations using familiar business-themed lures (DocuSign, Adobe, Zoom/Meet, Dropbox, Microsoft 365). After a victim engages, the attackers either steal Microsoft 365 sessions (enabling mailbox takeover and fraud) or…
A phishing kit dubbed N0va is targeting organizations in North America and Europe by impersonating familiar business services (like Microsoft Teams/SharePoint and DocuSign) and pushing victims through legitimate sign-in flows. By capturing authentication tokens rather than dropping obvious malware,…
Researchers reported a real phishing operation (“N0va” phishkit) that tricks people into signing into Microsoft through a legitimate Microsoft page, but for an attacker-started session. Victims can complete MFA and still grant the attacker access and refresh tokens, letting the attacker operate as…
CrowdStrike reports attackers increasingly bypass security tools by using trusted login paths, phone-based IT impersonation, and abuse of legitimate cloud and AI services. The report highlights real intrusions where vishing led to single sign-on takeovers and rapid data theft, and where attackers…
Microsoft says it disrupted “EvilTokens,” an AI-powered phishing-as-a-service operation used to break into email accounts at scale. The service automated device-code login phishing end-to-end, helping criminals steal authentication tokens and enable business email compromise across more than 10,000…
Microsoft says it disrupted “EvilTokens,” an AI-assisted phishing service used to trick employees into authorizing attacker access via the device-code login flow (often used for TVs/printers). Victims who entered an attacker-provided code in their browser unknowingly granted access tokens that…
