Phishing Kits Are Now Criminal Platforms in a Box, and They Target Microsoft 365

Phishing kits give aspiring attackers everything they need to steal credentials in one package. Huntress threat intelligence analyst Andrea Hatcher and Staff Product Manager Rich Mozeleski recently unpacked several kits during the company's Tradecraft Tuesday series, showing what the resulting activity looks like to defenders. A phishing kit is a pre-packaged set of code, templates and instructions for running a campaign and using the stolen credentials afterwards. Basic kits are simple HTML and script files that create a single fake login page. More advanced ones add admin dashboards where attackers can track victims, change phishing page content and relay credentials in real time.

Huntress has analysed three kits in recent months, all aimed at Microsoft 365 tokens. One is EvilTokens, a device-code phishing campaign that abused the Railway platform as a token-harvesting and token-replay engine. A few weeks before the broadcast, a Microsoft Digital Crimes Unit and FBI collaboration led to the arrest of one of its alleged operators. Mozeleski said finding EvilTokens in February "opened the dam" for research into phishing kits, and likened its professional look and 24/7 support to a software-as-a-service business.

Hatcher also described the control panel of another kit, Kali365, as an entire criminal ecosystem in a box, including AI features. In her words, it helps an operator acquire infrastructure, collect authentication material, retain access and scale up. The source excerpt does not cover the full details of each kit.