From Kali365 to a Wider Device-Code Phishing Ecosystem: A Webamon Intel Pivot Chain

In April–2026, several vendors began writing about Kali365, a phishing-as-a-service (PhaaS) kit being used against MSPs and their downstream clients:

• Arctic Wolf — "Token Bingo: Don't Let Your Code Be the Winner"
• Guardz — "The Rise of Kali365 and Why MSPs Should Be Concerned"
• Gurucul — "New Kali365 PhaaS Kit Being Abused" (28 Apr 2026)

This write-up starts as a Kali365-specific pivot chain through Webamon Intel and confirmed via the shared api.kali365.xyz C2. Let's start digging it with Webamon Intel.

Starting point: the lure page title

Device-code phishing pages need to show the user a short code and instructions, so they tend to reuse a small set of page titles almost verbatim across campaigns/kits. The most common is simply:

page_title:"Enter code"

page_title:"Enter code"

The single query returned 40 results across a mix of source tags (nrd_*, community), a reminder that "Enter code" alone is noisy. After analysis of few webpages, one of the webpages http://base-mail-w7v5.p-onnw7z7w[.]workers[.]dev/l/HIsIZyFiqps/ shows a Microsoft device-code phishing page. Here are few observations I find in it:

• Branded with the Microsoft four-square logo and "Enter code" / "Sign in" copy.
• Displays a hardcoded verification code (G42DT3TRY in this sample) and a Copy to clipboard button
• The Sign in button opens a real login.microsoftonline.com/common/oauth2/deviceauth popup.

Narrowing the "Enter code" set to genuine device-code phish

By combining the page title "Enter code" with the one artifact "login.microsoftonline.com/common/oauth2/deviceauth", the result can be narrow down.

page_title:"Enter code" AND dom:"login.microsoftonline.com/common/oauth2/deviceauth"

page_title:"Enter code" AND dom:"login.microsoftonline.com/common/oauth2/deviceauth"

This dropped the result set from 40 to 8 — all tagged webamon_x and openphish, and all resolving through *.workers.dev (Cloudflare Workers) subdomains following a consistent naming convention: -mail-.p-.workers[.]dev and -net-.p-.workers[.]dev.

• http://base-mail-w7v5.p-onnw7z7w[.]workers[.]dev/l/HIsIZyFiqps/
• https://gmkcb-bdxh-03l9.c-cmd509g3[.]workers[.]dev/l/xxey0ynPx6g
• https://sync-net-jq6r.p-l9b2vdvo[.]workers[.]dev/l/ioUewmHNZGQ
• https://gmkcb-bdxh-03l9.c-cmd509g3[.]workers[.]dev/l/xxey0ynPx6g
• https://core-mail-etk1.p-b8eaz6oe[.]workers[.]dev/l/jlBf9b9Axoo
• https://core-mail-etk1.p-b8eaz6oe[.]workers[.]dev/l/eTS_jQszpek
• https://egvmu-ejrp-8rmc.royalbase3[.]workers[.]dev/lp/s7M2RmZRac8
• https://hecpj-droq-zn73.lovelead247[.]workers[.]dev/lp/5bOOGYZk8cE

Pivoting off the C2 host

api.kali365.xyz is the single load-bearing artifact that ties every capture-and-poll instance of this kit together, regardless of what the lure page looks like or what domain it's hosted on. Let's try pivoting on the DOM reference to discover new webpages:

dom:"api.kali365.xyz" AND NOT page_title:"Enter code"

dom:"api.kali365.xyz" AND NOT page_title:"Enter code"

The result shows 8 unique hits having all tagged with webamon_x and openphish and still on *.workers.dev Cloudflare Workers infrastructure.

• https://egvmu-ejrp-8rmc.royalbase3[.]workers[.]dev/lp/xBbaUc6EqB0/
• http://acqxx-nikg-5cub.p-8kehah0a[.]workers[.]dev/lp/e1iOY1fCFzU/
• https://egvmu-ejrp-8rmc.royalbase3[.]workers[.]dev/lp/t1by4qFumMA
• https://egvmu-ejrp-8rmc.royalbase3[.]workers[.]dev/lp/H3OfcnojIXE
• https://jieyo-ohdk-45jv.c-01md9x3b[.]workers[.]dev/lp/Oy6KFribkAw/
• https://jnelw-lemp-etiw.p-je675f6e[.]workers[.]dev/lp/BWBJA9KG8PI/
• https://mcmxi-gqfo-drcb.c-7pklywd3[.]workers[.]dev/lp/mMZPdQFgvaU
• http://form-cloud-t655.p-oejdzrsz[.]workers[.]dev/lp/7NSnHwLNjJ8/

There are 5 different titles found in the pivot which shows variation of webpages involving Teams, SharePoint and Outlook.

• Shared Document — Teams Meeting (Teams-branded document share)
• SharePoint — Shared Document (SharePoint-branded document share)
• Shared Document — Outlook (Outlook-branded document share)
• Microsoft User shared a document with you (Generic M365 share notification)
• Shared document (Generic)

Expanding the "Shared document" lure family

While other titles didn't shows any interesting pivots but "Shared document" expands the pivot from Kali365 Kits to different generic phishing pages.

page_title:"Shared document"

page_title:"Shared document"

The query results in 57 records having almost 18 unique webpages. The pivot shows 5 new titles:

• OneDrive — Shared Document
• Shared Document — Microsoft OneDrive
• Excel :: Shared Document
• Shared Document
• Shared Document — OneDrive

Analyzing few webpages shows different type of phishing pages. Let's have a overview of families.

Family A — Direct credential-capture forms

Static-looking OneDrive/SharePoint clones (neretvapsicologas[.]com, stfrancisncc[.]com) that render a document preview and immediately serve, or link to, an email/password capture form. No device-code component, no Kali365 API reference; classic phishing, kit unidentified.

Family B — Bot-gated Workers/Pages redirector

A recurring, near-byte-identical HTML/JS shell (neon-flow-t4q6-m9k2p7ye.pages[.]dev, 1995[.]site, 100tttfdf01[.]shop, and an earlier -s-account.workers.dev-style sample) that:

• Displays a fake "Opening Shared Document… Verifying access permissions" progress bar.
• Performs client-side bot/sandbox evasion checks before execution.
• Detects automation via navigator.webdriver, headless/automation user agents, and missing browser features.
• Checks environment indicators such as WebGL, navigator.languages, window.chrome, screen size, hardwareConcurrency, and CPU timing.
• Redirects only if all evasion checks pass.
• Uses window.location.replace() to send the victim to a second-stage Workers/Pages URL.
• Passes the victim's email as a query parameter (e.g., ?email=victim@target.tld).
• Ultimately lands on a page that opens login.microsoftonline.com/common/oauth2/deviceauth.
• Uses the same Microsoft device-code phishing technique as Kali365, but with different tooling.

It closely matches a distinct campaign publicly documented in Microsoft's own write-up on an AI-assisted device-code phishing campaign (Microsoft Security Blog, Apr 2026), describing multi-stage redirects through Vercel/Cloudflare Workers/AWS Lambda ending in either a browser-in-the-browser or a blurred-document-preview page with a "Verify identity" button leading to deviceauth.

Family C — DocuSign/OneDrive lookalike domains

Typosquat-style domains impersonating document-signing/sharing brands directly in the FQDN: driversloged[.]sbs/lure/docusign, viewdocsigntureportal[.]icu, gorgeous-puffpuff-d1509c.netlify[.]app, plus a small cluster of Microsoft-branded domains registered outright — accountant-drive-download[.]com, accountauthenticator-365[.]com, 365-officeauthentification[.]com — all using "Microsoft/365/account/authenticat*" keyword-stuffing, a classic new-domain phishing registration pattern.

Here is the list of domains found in these three cluster:

• https://neretvapsicologas[.]com/
• http://driversloged[.]sbs/lure/docusign
• http://stfrancisncc[.]com/
• https://neon-flow-t4q6-m9k2p7ye[.]page
• https://viewdocsigntureportal[.]icu/
• http://1995[.]site/
• http://accountant-drive-download[.]com/
• http://accountauthenticator-365[.]com/
• http://365-officeauthentification[.]com/
• https://100tttfdf01[.]shop/
• https://gorgeous-puffpuff-d1509c[.]net
• https://iragift[.]com/Land/
• https://amazing-bunny-adeec8[.]netlify[.]app/
• https://review-documents[.]cloud/

Conclusion

Starting from a single high-signal string (page_title:"Enter code") and tightening it against one architectural fact every real Microsoft device-code clone must contain (a reference to login.microsoftonline.com/common/oauth2/deviceauth) was enough to go from 40 noisy hits down to a confirmed, C2-anchored Kali365 cluster in two queries. Pivoting on that C2 host (api.kali365.xyz) then unlocked the kit's other lure skins for free — proof that a backend artifact, not a page title, is what actually defines a cluster.

The second half of the chain is the more important lesson. Extending the same pretext (page_title:"Shared document") without re-anchoring to a backend artifact produced a 57-result and the largest sub-cluster (Family B) turned out to be a structurally different, separately documented device-code campaign that simply reuses the same social-engineering theme and the same abused Microsoft OAuth flow.

Note: I have moved my research blog from webamon.com to my personal medium blog and asked them to remove from there site as I am not working as Comunity Threat Researcher anymore.