Inside Kali365, a Device Code Phishing Ecosystem | Huntress

What it is

Kali365 (aka Octopi365 / Freedom365), a device-code phishing-as-a-service kit, as seen in a specific Huntress SOC intrusion set. Beyond the kit's features, this post gives the operational telltales of an active campaign: what the events looked like on the wire and what the victim experienced.

How it works

The lure the SOC saw started with an email pointing to a Canva-hosted page claiming the message was encrypted. Clicking "CLICK HERE" surfaced a device code, then a legitimate Microsoft login page. Once the victim signed in and entered the code, the attacker's device was authorized and the victim was dumped to a "Document Expired" page. Per the browser-history timeline, persistent access was gained in as little as 42 seconds. The panels are React SPAs, so much of the tooling is readable via F12; Huntress identified three "editions" (E1/E2/E3) with a shared set of 33 lure templates.

flowchart LR
  A[Encrypted-email lure] --> B[Canva page: CLICK HERE]
  B --> C[Device code shown]
  C --> D[Real Microsoft login]
  D --> E[Victim enters code]
  E --> F[Attacker device authorized ~42s]
  F --> G[Persistent token, survives MFA + password reset]

Preconditions / Affected

Microsoft 365 / Entra tenants where users can be socially engineered through the device authorization grant. MFA and post-compromise password changes do not evict the attacker, because the stolen refresh token persists.

What to do

The page's core actionable point is a hunting signal, not a patch:

• Treat device code authentication events as a lead for broader compromise (token abuse, mailbox access, persistence, infrastructure), not a one-off anomaly.
• In this campaign the successful UserLoggedIn events originated from Tencent Cloud IP addresses in AS132203, spiking May 20, 2026 with 80+ successful logins (activity spanned May 18–27). Hunt sign-ins matching that AS/geo pattern.
• Huntress used Validin to pivot across the infrastructure, finding 150+ IPs hosting panel variants (most on Tencent Cloud).
• Watch for abuse of the Microsoft Authentication Broker client ID minting refresh tokens (consistent with Storm-2372), which enables downstream device registration and email access.

Caveats

The three edition labels (E1/E2/E3) are Huntress's arbitrary naming, ordered by analysis, not a capability tier. The relationship between the Kali365 / Octopi365 / Freedom365 names is unresolved — possibly rebranding, theft, or operator "shenanigans." Attribution of first-observed-April-2026 is credited to the FBI. The post itself discloses AI assistance was used in the analysis and write-up.