The Kali365 phishing kit has expanded beyond its original focus on Microsoft 365, with researchers observing attacks targeting AWS, Okta, Xerox DocuShare, MAX Messenger, GMX, Mail.ru, Yandex Disk, and Odnoklassniki. The expansion highlights how attackers are increasingly targeting cloud identities and authentication workflows rather than relying solely on credential theft.<\/p>\n
Unlike traditional phishing campaigns that steal usernames and passwords, Kali365 uses device code phishing to abuse legitimate OAuth authentication processes. Victims are tricked into completing a valid sign-in flow, resulting in OAuth access tokens being issued to an attacker-controlled session.<\/p>\n
The broader targeting suggests that device code phishing is no longer limited to Microsoft-centric environments. As organizations continue to adopt cloud applications, SSO platforms, and federated identity services, OAuth token theft and identity-focused attacks<\/a> are becoming increasingly important considerations for security teams.<\/p>\n