Threat: Kali365

Entra ID Device Registration with Phishing Kit Default OS Build

Jul 7, 2026 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Microsoft Entra ID Data Source: Microsoft Entra ID Audit Logs Use Case: Identity and Access Audit Use Case: Threat Detection Threat: Tycoon2FA Threat: Kali365 Tactic: Persistence Resources: Investigation Guide ·

Share on:

Identifies a Microsoft Entra ID device registration where the recorded cloud device operating system build is "10.0.19045.2006" and the device display name follows the default "DESKTOP-" pattern. This is the frozen default device profile observed when adversary-in-the-middle (AiTM) phishing kits such as Tycoon2FA and Kali365 register Azure AD-joined devices after capturing a victim session, in order to acquire a Primary Refresh Token (PRT) and establish persistence. The build is hardcoded by the tooling and it is uncommon for the OS build to match this exact value across an environment of otherwise patched hosts, where a current Windows 10 22H2 device reports a far higher "10.0.19045." value.

Entra ID Phishing Kit Default OS Build (Entity Analytics)

Jul 7, 2026 · Domain: Cloud Domain: Identity Data Source: Microsoft Entra ID Data Source: Microsoft Entra ID Entity Analytics Use Case: Asset Visibility Use Case: Threat Detection Threat: Tycoon2FA Threat: Kali365 Tactic: Persistence Resources: Investigation Guide ·

Share on:

Identifies the first occurrence of a Microsoft Entra ID device, surfaced through the Entra ID Entity Analytics device inventory, whose host name follows the default "DESKTOP-" pattern and whose operating system build is "10.0.19045.2006". This is the frozen default device profile observed when adversary-in-the-middle (AiTM) phishing kits such as Tycoon2FA and Kali365 register Azure AD-joined devices after capturing a victim session, in order to acquire a Primary Refresh Token (PRT) and establish persistence. The build is hardcoded by the tooling and differs from legitimate hosts: a patched Windows 10 22H2 device reports a far higher "10.0.19045." value, so a device frozen at ".2006" with a default name is a high-fidelity, though evadable, indicator.

Entra ID Kali365 Default User-Agent Detected

May 27, 2026 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Microsoft Entra ID Data Source: Microsoft Entra ID Sign-in Logs Data Source: Microsoft Entra ID Audit Logs Data Source: Microsoft 365 Data Source: Microsoft 365 Audit Logs Use Case: Identity and Access Audit Use Case: Threat Detection Threat: Kali365 Tactic: Initial Access Tactic: Credential Access Resources: Investigation Guide ·

Share on:

Identifies the default user agent string associated with Kali365 (also referred to as Kali365 Live), a phishing-as-a-service (PhaaS) platform that automates OAuth 2.0 device code phishing and adversary-in-the-middle (AiTM) session capture against Microsoft 365 and Microsoft Entra ID. The Kali365 Electron desktop client identifies itself with the user agent kali365-live/1.0.0 when polling for and replaying captured OAuth tokens, so its appearance in Entra ID sign-in logs, Entra ID audit logs, or the Microsoft 365 unified audit log indicates that an attacker-controlled Kali365 client is interacting with the tenant using stolen tokens. Unlike dual-use offensive tooling, Kali365 is a criminal service with no legitimate enterprise use, making this user agent a high-fidelity indicator of active account compromise.