Kali365 phishing kit
Kali365 is a phishing-as-a-service kit that starts a Microsoft device-code session and asks the visitor to authorize it. We have matched it on 150 sites since 13 August.
Kali365 in numbers
Since 13 August, the first Kali365 match in our records, counted on 12 October 2026. How we count.
| Sites with Kali365 code | 150 |
|---|---|
| Sites with a match in the last 30 days | 79 |
| New sites in September | 86 |
| Sites captured since 25 September | 34 |
Huntress documented the Kali365 platform
Huntress documented Kali365 as a phishing-as-a-service platform built around Microsoft device-code authentication. Its panel supplies document, mail, collaboration and signing lures. Captured websites show how those lures start and monitor the operator's session.
The pages arrive through hosted projects, object storage and attacker-controlled domains with randomized paths. A deployment can serve a complete lure, a lightweight loader or a browser challenge that releases the next page.
A shared document leads to Microsoft's sign-in
One captured page presents a OneDrive-styled shared PDF. The visitor's path is explicit:
- Click the sign-in button on the document page.
- Receive a short code from the page's start endpoint.
- Copy the code, usually through the Clipboard API with a legacy fallback.
- Open Microsoft's verification page in a new window and enter the code.
- Return to the first tab while it polls for a completed session.
The start response contains fields such as session_id, user_code and verification_uri_complete. The page keeps the session ID and polls its status endpoint every few seconds. Captured responses use states for completion, expiry and rejection. Completion changes the page to a success message or sends the browser to the configured final address.
Several gates can sit ahead of the lure
One challenge uses an off-screen phone field as a honeypot and watches for request interception. Another encrypts browser telemetry into a hidden continuation value. Lightweight loaders remove automation flags, add plausible browser-plugin entries and open the staged page inside a sandboxed iframe.
Other variants post a browser fingerprint and replace the current document with the reply. Page wrappers decrypt or decode the lure with XOR, AES, Caesar or xorshift routines. These layers change the first response an investigator sees, while the copied device code, Microsoft window and session polling identify the visitor flow after the gate.
Some copies fail before a session starts and render a blank code or a loading error. The remaining script still exposes the start, copy and poll sequence.
What we see
| Month | New sites |
|---|---|
| September | 86 |
| October so far | 18 |
Among successful captures since 25 September, 0 of 34 Kali365 sites ran WordPress.
Checking a Kali365 page
Record the initial response and later document replacements while opening the exact path. Look for:
- a short code copied before Microsoft's verification page opens
- fields such as
userCode,sessionIdorverificationUriComplete - repeated status requests tied to the session ID
- instructions to return to the first tab after Microsoft sign-in
- a hidden honeypot field or encrypted browser telemetry ahead of the lure
- code that changes
navigator.webdriver, adds plugin entries or opens a sandboxed iframe - XOR, AES, Caesar or xorshift decoding before the lure appears
Remove the lure, its loaders and its session routes. Review hosting, DNS and deployment access and rotate their credentials.