CVE-2026-8398
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: a supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions… EPSS 15% (95th percentile).
CISA federal remediation date May 30 · date passed
Malware & Tooling · Credential Theft
Kali365 has moved past a Microsoft 365 token-theft niche into a broader account-compromise service. The change matters because the same device-code phishing flow that steals an M365 session can now be turned against cloud identities and IdPs, so a mailbox problem starts to look like a cloud-admin problem.
Arctic Wolf says the kit now targets AWS, Okta, Xerox DocuShare, and Russian services including MAX Messenger. That widens the blast radius from email access to identity and control-plane access, and the MAX target hints the operators may also be using account takeovers for propagation, not just one-off credential theft.
For teams that rely on Microsoft, Okta, AWS, or federated sign-in, the defensive model has to assume the token-grab workflow is portable across services. Patching one product or teaching users to watch for one brand of phishing is no longer enough to describe the risk.
10 sources · Jun 3
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: a supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions… EPSS 15% (95th percentile).
CISA federal remediation date May 30 · date passed
Dark Reading
FBI-Flagged Phishing Kit Kali365 Expands Its Reach
From solely targeting Microsoft 365, the phishing-as-a-service platform now targets AWS, Okta, and Russian platforms.
originalThe Hacker News
ThreatsDay Bulletin: Claude Security Plugin, Azure Priv-Esc, Kali365 MFA Bypass, FIFA Scams +15 More
ThreatsDay Bulletin: Kali365 MFA bypass, Azure priv-esc, FIFA scams, OAuth theft, fake installers, and supply chain attacks.
originalGraham Cluley
FBI warns of Kali365 phishing kit that breaks into Microsoft 365 accounts — no password required
So, you've enabled multi-factor authentication.
originalPart of the PlainSec briefing for 2026-05-22
Every edition of this story: Kali365 Expands Beyond Microsoft 365 Tokens