Malware · 120 giorni fa
Kali365 è passato da una nicchia di furto di token di Microsoft 365 a un servizio più ampio di compromissione degli account. Il cambiamento è importante perché lo stesso flusso di phishing con device-code che ruba una sessione M365 ora può essere usato contro identità cloud e IdP, quindi un problema di mailbox inizia ad assomigliare a un problema di cloud-admin.
Sfruttamento noto · CISA KEV
CVSS 9.8 CRITICAL: a supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions… EPSS 15% (95º percentile).
Data di correzione federale CISA 30 mag · data superata
10 fonti che coprono questa storia
FBI-Flagged Phishing Kit Kali365 Expands Its Reach
From solely targeting Microsoft 365, the phishing-as-a-service platform now targets AWS, Okta, and Russian platforms.
ThreatsDay Bulletin: Claude Security Plugin, Azure Priv-Esc, Kali365 MFA Bypass, FIFA Scams +15 More
ThreatsDay Bulletin: Kali365 MFA bypass, Azure priv-esc, FIFA scams, OAuth theft, fake installers, and supply chain attacks.
FBI warns of Kali365 phishing kit that breaks into Microsoft 365 accounts — no password required
So, you've enabled multi-factor authentication.
FBI warns about PhaaS platform used to access Microsoft 365 environments
Device code phishing enabled hackers to bypass multifactor authentication without credentials.
FBI warns of Kali365 phishing service targeting Microsoft 365 accounts
The FBI is warning about the Kali365 phishing-as-a-service platform (PhaaS) that is used to hijack Microsoft 365 accounts by abusing OAuth device code authentication to steal session tokens and bypass multi-factor authentication (MFA).
FBI Warns 'Kali365' Phishing Kit Hijacks Microsoft 365 OAuth Tokens
The Kali365 phishing-as-a-service platform lowers the barrier of entry for cybercriminals, said the FBI
FBI warns about fast-growing phishing kit targeting Microsoft 365 users
Kali365, which was first observed in April, abuses legitimate Microsoft device authorization pages to grant persistent access to cybercriminal-controlled applications.
The Record from Recorded Future
FBI warns of Kali365 phishing-as-a-service after April Microsoft 365 attacks
The law enforcement agency published an advisory on Thursday about Kali365 — a Telegram-based service for cybercriminals that allows them to capture legitimate "OAuth" tokens enabling widespread access to Microsoft 365 environments.
FBI warns of Kali Oauth stealers
A new phishing attack platform endangers Microsoft environments.
Microsoft 365 users targeted by new phishing threat that bypasses MFA - Help Net Security
Kali365 is targeting Microsoft 365 users through device code phishing, using OAuth token theft and Telegram-based distribution.
Riepilogo fornitore: Microsoft
Part of the PlainSec briefing for 2026-05-23