Malware & Tooling · Credential Theft

Kali365 Expands Beyond Microsoft 365 Tokens

Kali365 has moved past a Microsoft 365 token-theft niche into a broader account-compromise service. The change matters because the same device-code phishing flow that steals an M365 session can now be turned against cloud identities and IdPs, so a mailbox problem starts to look like a cloud-admin problem.

Arctic Wolf says the kit now targets AWS, Okta, Xerox DocuShare, and Russian services including MAX Messenger. That widens the blast radius from email access to identity and control-plane access, and the MAX target hints the operators may also be using account takeovers for propagation, not just one-off credential theft.

For teams that rely on Microsoft, Okta, AWS, or federated sign-in, the defensive model has to assume the token-grab workflow is portable across services. Patching one product or teaching users to watch for one brand of phishing is no longer enough to describe the risk.

10 sources · Jun 3

CVE-2026-8398

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: a supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions… EPSS 15% (95th percentile).

CISA federal remediation date May 30 · date passed

Timeline

Jun 3 Reported by Dark Reading
May 30 CISA federal deadline for CVE-2026-8398 passed
May 28 Reported by The Hacker News
May 26 Reported by Graham Cluley
May 25 Reported by BleepingComputer
May 22 Reported by CyberScoop

Sources

Jun 3 Dark Reading
FBI-Flagged Phishing Kit Kali365 Expands Its Reach
From solely targeting Microsoft 365, the phishing-as-a-service platform now targets AWS, Okta, and Russian platforms.
original
May 28 The Hacker News
ThreatsDay Bulletin: Claude Security Plugin, Azure Priv-Esc, Kali365 MFA Bypass, FIFA Scams +15 More
ThreatsDay Bulletin: Kali365 MFA bypass, Azure priv-esc, FIFA scams, OAuth theft, fake installers, and supply chain attacks.
original
May 26 Graham Cluley
FBI warns of Kali365 phishing kit that breaks into Microsoft 365 accounts — no password required
So, you've enabled multi-factor authentication.
original

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-05-23

Every edition of this story: Kali365 Expands Beyond Microsoft 365 Tokens

Malware & Tooling · Credential TheftKali365 Expands Beyond Microsoft 365 TokensKali365 has moved past a Microsoft 365 token-theft niche into a broader account-compromise service. The change matters because the same device-code phishing flow that steals an M365 session can now be turned against cloud identities and IdPs, so a mailbox problem starts to look like a cloud-admin problem.Arctic Wolf says the kit now targets AWS, Okta, Xerox DocuShare, and Russian services including MAX Messenger. That widens the blast radius from email access to identity and control-plane access, and the MAX target hints the operators may also be using account takeovers for propagation, not just one-off credential theft.For teams that rely on Microsoft, Okta, AWS, or federated sign-in, the defensive model has to assume the token-grab workflow is portable across services. Patching one product or teaching users to watch for one brand of phishing is no longer enough to describe the risk.10 sources · Jun 3

CVE-2026-8398

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: a supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions… EPSS 15% (95th percentile).

CISA federal remediation date May 30 · date passed

Timeline

Jun 3 Reported by Dark Reading

May 30 CISA federal deadline for CVE-2026-8398 passed

May 28 Reported by The Hacker News

May 26 Reported by Graham Cluley

May 25 Reported by BleepingComputer

May 22 Reported by CyberScoop

Sources

Jun 3 Dark Reading

FBI-Flagged Phishing Kit Kali365 Expands Its Reach

From solely targeting Microsoft 365, the phishing-as-a-service platform now targets AWS, Okta, and Russian platforms.

original

May 28 The Hacker News

ThreatsDay Bulletin: Claude Security Plugin, Azure Priv-Esc, Kali365 MFA Bypass, FIFA Scams +15 More

ThreatsDay Bulletin: Kali365 MFA bypass, Azure priv-esc, FIFA scams, OAuth theft, fake installers, and supply chain attacks.

original

May 26 Graham Cluley

FBI warns of Kali365 phishing kit that breaks into Microsoft 365 accounts — no password required

So, you've enabled multi-factor authentication.

original

Vendor digest: MicrosoftPart of the PlainSec briefing for 2026-05-23Every edition of this story: Kali365 Expands Beyond Microsoft 365 Tokens