Voicemail Lure Drives Microsoft Device-Code Phish

How the attack worked

The campaign, tracked as Kali365 Ringer, began with a voicemail-style notification telling the recipient they had a missed call and needed to review a message. This simple pretext gave the attacker a reason to push the user toward a link. Clicking through led to a page built on Google Sites, a legitimate hosting platform that gave the phishing content a familiar, trustworthy appearance rather than an obvious spoofed domain.

From there, the victim was redirected through a chain of well-known services, including a Google redirector and an OCI API Gateway, before landing on a Cloudflare-protected host controlled by the attacker. Rather than presenting a fake login form to harvest a password, the page instructed the user to authorize a Microsoft device-code session. Approving that prompt handed the attacker an active, authenticated session without ever touching the victim's password.

Why it succeeded

Several design choices made this lure effective:

• A voicemail or missed-call theme creates a sense of missing something important, prompting quick action.
• Using Google Sites as a wrapper avoids the visual red flags of an unfamiliar or misspelled domain.
• Routing traffic through multiple reputable platforms before reaching attacker infrastructure adds legitimacy and can complicate detection.
• Asking for device-code approval instead of a password sidesteps user training focused on spotting fake login pages.

What to watch for

Defenders and employees should be alert to a few consistent signals from this campaign:

• Unexpected voicemail or missed-call notifications that push a login or approval action.
• Login or authorization flows hosted on general-purpose site builders like Google Sites rather than a known corporate domain.
• Multiple redirects through unrelated third-party services before reaching a final page.
• Any Microsoft device-code prompt that appears without the user having initiated a sign-in themselves.

The same landing page, sender subdomain, subject pattern, and fake internal reference ID were reused across multiple financial and insurance organizations targeted on the same day, a pattern that security teams can use to detect and block related campaign infrastructure quickly.

Building resistance

Organizations, particularly in finance and insurance where this campaign concentrated, should reinforce a simple rule: never approve a Microsoft device-code or device login prompt that was not self-initiated. Employees should also be encouraged to verify unexpected voicemail or missed-call messages through known internal channels before clicking any embedded link. Because this technique bypasses traditional password-harvesting defenses, awareness training should specifically cover device-code approval flows, not just fake login pages, and staff should have a clear, fast path to report suspicious authorization requests to IT or helpdesk teams.

What is the Kali365 Ringer attack?

Kali365 Ringer is a device-code phishing campaign identified by ZeroBEC that used a fake missed-call voicemail notification to lure users toward approving an attacker-controlled Microsoft login session.

Why is device-code phishing dangerous?

Instead of stealing a password on a fake login page, the attacker has the victim approve a real Microsoft device-code session, giving access without ever needing to steal or guess credentials.

How did the attackers make the phishing page look legitimate?

The campaign used a trusted Google Sites wrapper and routed victims through multiple reputable platforms, including a Google redirector, an OCI API Gateway, and a Cloudflare-protected host, before reaching the final destination.

Who was targeted in this campaign?

The campaign targeted an unnamed regulated financial customer and reused the same landing page, subject pattern, and fake internal reference ID against multiple financial and insurance organizations on the same day.