Token Bingo: Don’t Let Your Code be the Winner

A sophisticated, large-scale device code phishing campaign leveraging Kali365’s phishing-as-a-service platform is enabling threat actors to hijack Microsoft 365 accounts by tricking victims into authorizing malicious sessions, bypassing traditional credential defenses and extending attacker dwell time.