Kali365 Weaponizes Microsoft Authentication Against US Companies: New Enterprise Risk

Kali365 is exploiting a legitimate Microsoft login process to gain access to corporate data of US companies. The phishing kit uses attacker-controlled device codes that are approved by victims on Microsoft's actual authentication page. This allows attackers to obtain access and refresh tokens, which can be used to access email, documents, and cloud resources. As a result, attackers may be able to retain access to sensitive data, potentially leading to data exposure and financial fraud. The attack creates a direct pathway for attackers to compromise corporate systems and data.