FBI-Flagged Phishing Kit Kali365 Expands Its Reach
FBI-flagged Kali365 phishing kit expands from Microsoft 365 to AWS, Okta, and Russian platforms
Kali365, a phishing-as-a-service platform previously flagged by the FBI for targeting Microsoft 365 users, has expanded its attack scope to include AWS, Okta, and Russian cloud platforms. The toolkit leverages device code phishing techniques to bypass multi-factor authentication and harvest credentials. This expansion demonstrates the evolving sophistication of commercially available phishing infrastructure and the broadening threat to enterprise authentication systems across multiple cloud providers.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Kali365 phishing-as-a-service platform demonstrates how attackers are evolving to target multiple cloud providers simultaneously, including Microsoft 365, AWS, and Okta. This toolkit uses advanced device code phishing techniques that can bypass traditional multi-factor authentication, highlighting the limitations of basic MFA implementations. The commercial availability of such sophisticated phishing infrastructure means that even less skilled attackers can now execute complex credential harvesting campaigns. Organizations relying solely on standard MFA for protection against phishing are at significant risk of compromise across their entire cloud ecosystem.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Kali365