Tradecraft Tuesday | Advanced Phishing for Entry-Level Attackers

BLUF: Huntress threat intel experts explain how modern phishing kits like EvilTokens and Cali365 have become SaaS-style cybercrime ecosystems that capture authenticated session tokens rather than passwords 1:49.

Key Takeaways:
• Kits are professionalized platforms: EvilTokens offered 24/7 support and a polished operator web app—effectively SaaS for criminals—and led to a Microsoft-coordinated arrest 5:57.
• Cali365 was a full ecosystem with 100+ API endpoints, AI-assisted BEC, and a token vault—operators rent infrastructure instead of building kits 9:58.
• The goal is the session, not the password: adversary-in-the-middle kits relay auth through the real IdP so MFA succeeds while attackers capture the resulting session 13:23.
• Device code phishing is exploding; 1 in 6 Huntress identity incidents now include post-compromise device registration 23:00.
• Detection should correlate the full chain (lure, auth, token, device registration, mailbox rules): "one signal is weak, the sequence is strong" 38:29.
• Containment speed is critical—attackers move from compromise to exfiltration in seconds, while Microsoft telemetry latency (minutes vs. Google's ~1 second) favors them 42:22.

Closing: Defenders should block device code authentication via conditional access, adopt phishing-resistant methods like passkeys, and assume post-compromise activity—limiting blast radius fast is the key defense.

Sources:

• 1:49 Session introduction
• 5:57 EvilTokens as productized SaaS phishing platform
• 9:58 Cali365 ecosystem and token vault
• 13:23 AiTM capture of authenticated sessions
• 23:00 Device code phishing mechanics
• 38:29 Detection: correlate the signal chain
• 42:22 Response speed and telemetry latency