[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwlAw8tU3-RREZ2f3tVj9EDUy5fjWVPx-s38DpV6atls":3},{"article":4,"iocs":40,"watch_terms":44,"solutions":45,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":24,"category":25,"article_tags":29},"b9ff926a-b6a0-4576-ab7c-d98c4803b74f","FBI-Flagged Phishing Kit Kali365 Expands Its Reach","fbi-flagged-phishing-kit-kali365-expands-its-reach-b67680","Once targeting just Microsoft 365, the phishing-as-a-service platform now aims at AWS, Okta, and Russian platforms, while relying on device code phishing.","Kali365, a phishing-as-a-service platform previously flagged by the FBI for targeting Microsoft 365 users, has expanded its attack scope to include AWS, Okta, and Russian cloud platforms. The toolkit leverages device code phishing techniques to bypass multi-factor authentication and harvest credentials. This expansion demonstrates the evolving sophistication of commercially available phishing infrastructure and the broadening threat to enterprise authentication systems across multiple cloud providers.","FBI-flagged Kali365 phishing kit expands from Microsoft 365 to AWS, Okta, and Russian platforms","https:\u002F\u002Fwww.darkreading.com\u002Fcyber-risk\u002Ffbi-flagged-phishing-kit-kali365-expands-its-reach","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblta4f731d1ead13c9d\u002F6a1f3ff44bb1191264ce8b45\u002Fphishing_babar_ali_1233_shutterstock.jpg?width=1280&auto=webp&quality=80&disable=upscale","2026-06-02T21:32:24+00:00","2026-06-02T22:00:23.561301+00:00",8,[17,20,22],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":19},"Amazon Web Services",{"name":23,"type":19},"Okta","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":24,"icon":26,"name":27,"slug":28},null,"Malware","malware",[30,35],{"category":31},{"id":32,"icon":26,"name":33,"slug":34},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":36},{"id":37,"icon":26,"name":38,"slug":39},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[41],{"type":28,"value":42,"context":43},"Kali365","Phishing-as-a-service platform targeting enterprise cloud services",[18,21,23],{"controls":46,"vendors":130},[47,75,101],{"slug":48,"name":49,"problem":50,"products":51},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[52,59,67],{"vendor_slug":53,"vendor_name":18,"vendor_logo":54,"product_slug":55,"product_name":56,"url":57,"description":58},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":76,"name":77,"problem":78,"products":79},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[80,85,93],{"vendor_slug":53,"vendor_name":18,"vendor_logo":54,"product_slug":81,"product_name":82,"url":83,"description":84},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":102,"name":103,"problem":104,"products":105},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[106,114,122],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",[131,134],{"slug":53,"name":18,"logo_path":54,"roles":132},[133],"affected",{"slug":135,"name":23,"logo_path":136,"roles":137},"okta","\u002Fvendor-logos\u002Fokta.png",[133],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":149},"sophisticated-phishing-kit-bypasses-mfa-across-multiple-cloud-platforms","Sophisticated Phishing Kit Bypasses MFA Across Multiple Cloud Platforms","The Kali365 phishing-as-a-service platform demonstrates how attackers are evolving to target multiple cloud providers simultaneously, including Microsoft 365, AWS, and Okta. This toolkit uses advanced device code phishing techniques that can bypass traditional multi-factor authentication, highlighting the limitations of basic MFA implementations. The commercial availability of such sophisticated phishing infrastructure means that even less skilled attackers can now execute complex credential harvesting campaigns. Organizations relying solely on standard MFA for protection against phishing are at significant risk of compromise across their entire cloud ecosystem.",[143,144,145,146,147,148],"NIST IA-2","NIST AT-2","CIS Control 6","CIS Control 14","NIST SI-4","NIST AC-7",{}]