Kali365 Phishing Kit Expands Beyond Microsoft 365 to Target More Services
Summary
Arctic Wolf reports that Kali365 has expanded beyond Microsoft 365 to target AWS, Okta, Xerox DocuShare and Russian services. Its device-code phishing captures OAuth tokens after victims complete authentication, while researchers identified 126 active malicious hosts.
Key points
- Arctic Wolf says Kali365 now targets AWS, Okta, Xerox DocuShare, GMX and Russian services including MAX Messenger, Mail.ru, Yandex Disk and Odnoklassniki.
- In device-code phishing, victims are tricked into completing an authentication request on a legitimate login page; the attacker then receives access tokens.
- The method can bypass MFA because victims complete the authentication and any required MFA steps themselves.
- Arctic Wolf identified 126 malicious hosts active between early and late May that served the same kit and impersonated multiple platforms.
- Arctic Wolf recommends security awareness training and describes additional measures in its report; Push Security reported at least 14 device-code phishing kits in the wild.
- Push Security warned that blocking device-code logins could disrupt some environments, and some applications lack tools to block them.
Article Details
- Event Type
- Expansion of the Kali365 phishing-as-a-service platform and its device-code phishing capabilities.
- Impact
- Arctic Wolf reports that Kali365 has expanded beyond Microsoft 365 to target AWS, Okta, Xerox DocuShare, and Russian online services. Victims who complete the device authorization and MFA steps can enable operators to capture OAuth access tokens and access accounts. Arctic Wolf identified 126 malicious hosts active between early and late May; the article does not report specific confirmed victim losses.
MITRE ATT&CK
Products
AWSexpanded from a Microsoft 365-focused phishing kit into a broader account-compromise platform targeting AWS, Okta, Xerox DocuShare, and major Russian services such as MAX Messenger, Mail.ru, Yandex Disk, andMail.ruplatform targeting AWS, Okta, Xerox DocuShare, and major Russian services such as MAX Messenger, Mail.ru, Yandex Disk, and Odnoklassniki.MAX Messengeraccount-compromise platform targeting AWS, Okta, Xerox DocuShare, and major Russian services such as MAX Messenger, Mail.ru, Yandex Disk, and Odnoklassniki.Microsoft 365 Apps for EnterpriseKali365 has expanded from a Microsoft 365-focused phishing kit into a broader account-compromise platform targeting AWS, Okta, Xerox DocuShare, and major Russian services such as MAX Messenger, Mail.ru, Yandex Disk, andOdnoklassnikiOkta, Xerox DocuShare, and major Russian services such as MAX Messenger, Mail.ru, Yandex Disk, and Odnoklassniki.Oktafrom a Microsoft 365-focused phishing kit into a broader account-compromise platform targeting AWS, Okta, Xerox DocuShare, and major Russian services such as MAX Messenger, Mail.ru, Yandex Disk, andXerox DocuSharea Microsoft 365-focused phishing kit into a broader account-compromise platform targeting AWS, Okta, Xerox DocuShare, and major Russian services such as MAX Messenger, Mail.ru, Yandex Disk, and Odnoklassniki.Yandex Disktargeting AWS, Okta, Xerox DocuShare, and major Russian services such as MAX Messenger, Mail.ru, Yandex Disk, and Odnoklassniki.
Tools
CYB3ROther examples include Tycoon2FA, Venom, and CYB3R.Kali365Kali365 has expanded from a Microsoft 365-focused phishing kit into a broader account-compromise platform targeting AWS, Okta, Xerox DocuShare, and major Russian services such as MAX Messenger, Mail.ru, Yandex Disk, andTycoon2FAOther examples include Tycoon2FA, Venom, and CYB3R.VenomOther examples include Tycoon2FA, Venom, and CYB3R.