FBI-Flagged Phishing Kit Kali365 Expands Its Reach
The Kali365 phishing-as-a-service platform, initially focused on compromising Microsoft 365 accounts via MFA bypass, has significantly expanded its capabilities and target list. It now actively targets platforms like AWS, Okta, and several Russian online services, including the state-backed MAX Messenger, utilizing device code phishing techniques. This expansion, highlighted by the FBI, represents a growing threat across multiple sectors and regions, demanding increased security awareness and proactive defenses.
Kali365 has evolved from a specialized tool for Microsoft 365 account compromise to a broader account-compromise platform. The platform now targets a diverse range of services, including AWS, Okta, and several Russian online services, most notably MAX Messenger, a messaging platform promoted by the Russian government. This expansion leverages device code phishing, exploiting authentication workflows on devices like smart TVs and printers to trick users into entering credentials on legitimate login pages. The FBI issued a public service announcement last month to warn users about the platform’s capabilities and methods.
Arctic Wolf’s analysis revealed a significant increase in Kali365’s activity, identifying 126 malicious hosts active between early and late May, impersonating a wide array of platforms. These include Microsoft Outlook, Okta SSO, Xerox DocuShare, GMX, Amazon Web Services, and major Russian services like Mail.ru and Yandex Disk. This broadened reach demonstrates a shift from a specialized tool to a more versatile credential theft platform, posing a significant risk to organizations across various sectors and geographic locations. The platform’s use of AI-generated lures and automated campaign templates further lowers the barrier to entry for less-technical attackers.
Several other device code phishing kits, such as Tycoon2FA, Venom, and CYB3R, have emerged recently, contributing to a surge in device code phishing activity. Security teams are urged to implement comprehensive security awareness training and actively monitor for suspicious activity related to these kits, particularly in applications where device code authorization grants are common.