Kali365

Kali365 is a device code phishing service that emerged in March 2026, shortly after the lauch of EvilTokens. The device code phishing attack technique is a post-authentication attack based on misleading a victim into authorising an external device for access to their account. This bypasses multi-factor authentication and does not require the recipient to enter their password into a malicious site at all.

Typical Kali365 landing page based on a shared document lure

Kali365 rapidly grew in popularity, even overtaking EvilTokens in terms of Push's measured breakthrough rate, until it was top of Push's breakthrough rate leaderboard in May 2026.

Push's original internal name for Kali365 was "CLURE", after a prominent JavaScript variable named in the tool's landing pages.

Device registration persistence

Push has observed the Kali365 framework registering a new device to a Microsoft Entra account immediately after compromise. This is done to provide the attacker with persistent access to the compromised account even if the initial session obtained via the phishing attack is revoked or expired, or if the user's password is reset.

Rogue device registered to compromised account

In this case, the device was registered using a connection with the user agent python-requests/2.34.2 from an IP in AS132203.

URL patterns

A typical phishing lure page associated with Kali365 uses one of two URL paths:

• /l/[token]
• /lp/[token]

Where the token is most commonly 11 characters of base64url ([A-Za-z0-9_-]{11}).

Push has observed multiple different hostname patterns:

• Cloudflare Workers - [4]-[4]-[4].[letter]-[8].workers.dev
• Public object storage:
  • AWS S3: [bucket].s3.us-east-1.amazonaws.com/[Lure_Name].pdf.html
  • Linode Objects: [bucket].us-southeast-1.linodeobjects.com/[Lure_Name].pdf.html
  • DigitalOcean Spaces: [space].sfo2.cdn.digitaloceanspaces.com/[Lure_Name].pdf.html
  • Azure Blob: [account].blob.core.windows.net/[container]/[Lure_Name].html
  • Cloudflare R2: https://pub-[hash].r2.dev/[Lure_Name].html
• Vercel Edge - E.g. swanvalleycoop.vercel[.]app, brantal.vercel[.]app, shewenterprise.vercel[.]app
• FlowerStorm associated domains - Random 10-character subomdains on business-jargon .de domain

Network traffic

The Kali365 landing page sends a background request to initiate a new device code authentication session and retrieve a code to display to the victim:

POST /api/generate?lure=[token] HTTP/1.1
Host: api.kali365[.]xyz
Content-Length: 0

HTTP/1.1 200 OK
{
    "expires_in": 900,
    "session_id": 24814,
    "success": true,
    "user_code": "ANY2PJD8D",
    "verification_uri": "https://login.microsoft.com/device",
    "verification_uri_complete": "https://login.microsoftonline.com/common/oauth2/deviceauth?otc=ANY2PJD8D"
}

After displaying the device authentication code to the victim, the page then polls a status endpoint to determine if authentication has occurred:

GET /api/status/[session_id] HTTP/1.1

{"status":"pending"}  →  captured | expired | declined

The session ID appears to be a simple incrementing integer, so it serves as an external indicator of the volume of traffic that a given Kali365 API backend has served.