Kali365 phishing kit
Kali365 is a phishing-as-a-service kit that starts a Microsoft device-code session and asks the visitor to authorize it. We have matched it on 427 sites since 3 August.
Kali365 in numbers
Since 3 August, the first Kali365 match in our records, counted on 12 November 2026. How we count.
| Sites with Kali365 code | 427 |
|---|---|
| Sites with a match in the last 30 days | 141 |
| New sites in October | 141 |
| Sites captured since 25 September | 182 |
Huntress documented the Kali365 platform
Huntress documented Kali365 as a phishing-as-a-service platform built around Microsoft device-code authentication. Its panel supplies document, mail, collaboration and signing lures. Captured websites show how those lures start and monitor the operator's session.
The pages arrive through hosted projects, object storage and attacker-controlled domains with randomized paths. A deployment can serve a complete lure, a lightweight loader or a browser challenge that releases the next page.
Kali365 also supplies other operations. Proofpoint reported that the operators it tracks as FlowerStorm added device-code phishing by using Kali365.
A shared document leads to Microsoft's sign-in
One captured page presents a OneDrive-styled shared PDF. The visitor's path is explicit:
- Click the sign-in button on the document page.
- Receive a short code from the page's start endpoint.
- Copy the code, usually through the Clipboard API with a legacy fallback.
- Open Microsoft's verification page in a new window and enter the code.
- Return to the first tab while it polls for a completed session.
The start response contains fields such as session_id, user_code and verification_uri_complete. The page keeps the session ID and polls its status endpoint every few seconds. Captured responses use states for completion, expiry and rejection. Completion changes the page to a success message or sends the browser to the configured final address.
Another device-code branch adds an MFA-choice relay. It offers push approval, a one-time code, a text message or a call. The page keeps the selected method and pending MFA state while it exchanges updates through /api/ngc/choose/ and /api/ngc/submit/.
A DocuSign document lure opens authentication in a separate pop-up and leaves the document page polling /api/status/. The relay handles captured, expired and declined states and returns the captured email address to the original page.
Several gates can sit ahead of the lure
The most common gate is a single verification checkbox that scores the visitor. It starts from a fixed score and adjusts it for navigator.webdriver, installed plugins, window dimensions and mouse, touch or scroll activity. A low score gets a decoy. A passing score submits a hidden form to /l/<token> with the visitor's email address, under field names that change with each copy.
The gate rarely arrives in plain text. One wrapper decodes it with xorshift and hex pairs and writes it into an element with the id _gw; others use XOR, AES or Caesar routines. Other challenges use an off-screen phone field as a honeypot, watch for request interception or encrypt browser telemetry into a hidden continuation value. Lightweight loaders remove automation flags, add plausible browser-plugin entries and open the staged page inside a sandboxed iframe.
Some copies fail before a session starts and render a blank code or a loading error. The remaining script still exposes the start, copy and poll sequence.
What we see
| Month | New sites |
|---|---|
| September | 114 |
| October | 141 |
| November so far | 30 |
Among successful captures since 25 September, 0 of 182 Kali365 sites ran WordPress.
Checking a Kali365 page
Record the initial response and later document replacements while opening the exact path. Look for:
- a short code copied before Microsoft's verification page opens
- fields such as
userCode,sessionIdorverificationUriComplete - repeated status requests tied to the session ID
- instructions to return to the first tab after Microsoft sign-in
- push, one-time-code, text-message or call choices tied to
/api/ngc/choose/and/api/ngc/submit/ - a DocuSign document page that opens an authentication pop-up and keeps polling
/api/status/ - a checkbox gate that scores
navigator.webdriver, plugins, window dimensions and interaction events, then posts the email address to/l/<token> - an
_gwelement filled by xorshift-decoded code, or XOR, AES or Caesar decoding before the lure appears - a hidden honeypot field or encrypted browser telemetry ahead of the lure
Remove the lure, its loaders and its session routes. Review hosting, DNS and deployment access and rotate their credentials.