Kali365

Reported Context (3)

is yet another phishing kit that relies on token theft, with other phishing services like EvilTokens and Kali365 centering their services around AiTM (session tokens) and device code phishing (OAuth access tokens). Knight Office AiTM Kit Steals Microsoft 365 Session Tokens and Establishes Persistent Access
The campaigns described in this blog appear to be the work of a single actor who leverages multiple AiTM phishing kits, including Evilginx, FlowerStorm, and Kali365, to harvest user credentials. AiTM Phishing Campaign Targets Global Institutions With Procurement-Themed Lures
Kali365 is targeting US organizations with device code phishing attacks that abuse legitimate Microsoft authentication. Kali365 Uses Device-Code Phishing to Target US Organizations and Obtain OAuth Tokens

People (9)

MITRE ATT&CK (13)

Vendors (3)

Products (15)

Tools (7)

Industries (11)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.