OAuth/OIDC token abuse, AiTM, and trusted-platform phishing
Key Questions
What is OAuth device-code flow abuse and how does it enable MFA bypass?
OAuth device-code abuse involves attackers using legitimate device-code flows in four-step sequences to steal tokens and bypass MFA protections. Tools like Tycoon2FA and Kali365 exploit this for cookie theft and impersonation in services like Teams and Microsoft 365. Recent campaigns, including those from Kaspersky and others, use PDF lures with CAPTCHAs to redirect users to legitimate login flows.
How is Kali365 evolving as a Chinese PhaaS platform?
Kali365 now integrates Claude AI to automate BEC attacks by reading victim inboxes, scoring fraud potential, and sending contextually accurate payment requests. It has expanded to target AWS, Okta, and Russian platforms while using real-time tokenization, AI page generation, and encrypted delivery via RCS/iMessage. FBI advisories confirm its focus on the finance sector with 126 malicious hosts identified by Arctic Wolf.
What is Forg365 and what defensive measures are recommended against it?
Forg365 is a PhaaS platform targeting Microsoft 365 with device-code phishing, AI-assisted response drafting, and a browser extension called ForgCookie for persistent access. It integrates with legitimate email services like SES and SendGrid for evasion and uses subscription pricing. Defenses include disabling device-code flows, monitoring for IOCs like logfriend[.]com, and implementing conditional access policies as outlined in related analyses.
Device-code phishing services such as EvilTokens and live-operator platforms such as ZeroTokens exploit trusted authentication flows to steal credentials, MFA codes, or OAuth tokens and support mailbox reconnaissance, persistence, and BEC. Huntress reports token-spraying and replay across 79 organizations, including MFA changes, registered devices, hidden rules, and a payroll lure; a Wisconsin DHS partner-phishing report also describes fake Microsoft login pages and rules concealing mailbox activity. New vendor-platform figures report a 41.1% rise in spear phishing, BEC at 51.2% of analyzed phishing, and 41.3% of dangerous messages bypassing secure email gateways, but add limited new technical detail.