[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQurZJ3Vi-U8U6TSGrG__rXb8pOpk2Rn4nYshlZSQ5G0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":18,"status":19,"created_at":20,"published_at":21,"article":22,"tags":26,"podcasts":39,"controls":40},"96ffe2ff-ea0c-456d-98ee-8c542737b6ff","sophisticated-phishing-kit-bypasses-mfa-across-multiple-cloud-platforms","b9ff926a-b6a0-4576-ab7c-d98c4803b74f","Sophisticated Phishing Kit Bypasses MFA Across Multiple Cloud Platforms","The Kali365 phishing-as-a-service platform demonstrates how attackers are evolving to target multiple cloud providers simultaneously, including Microsoft 365, AWS, and Okta. This toolkit uses advanced device code phishing techniques that can bypass traditional multi-factor authentication, highlighting the limitations of basic MFA implementations. The commercial availability of such sophisticated phishing infrastructure means that even less skilled attackers can now execute complex credential harvesting campaigns. Organizations relying solely on standard MFA for protection against phishing are at significant risk of compromise across their entire cloud ecosystem.","**Immediate actions:**\n- Deploy phishing-resistant authentication methods like FIDO2\u002FWebAuthn for all cloud platforms\n- Enable conditional access policies that block suspicious login locations and devices\n- Implement real-time monitoring for device code authentication requests\n\n**Security awareness measures:**\n- Train users to recognize device code phishing attempts and suspicious authentication prompts\n- Establish clear procedures for reporting suspected phishing attempts targeting cloud credentials\n- Conduct regular simulated phishing exercises that include device code attack scenarios\n\n**Long-term improvements:**\n- Implement zero-trust architecture with continuous authentication validation\n- Deploy email security solutions that detect and block phishing kit infrastructure\n- Establish threat intelligence feeds to identify emerging phishing-as-a-service platforms",[12,13,14,15,16,17],"NIST IA-2","NIST AT-2","CIS Control 6","CIS Control 14","NIST SI-4","NIST AC-7",{},"published","2026-06-02T22:07:04.534961+00:00","2026-06-02T22:07:04.458+00:00",{"id":7,"url":23,"slug":24,"title":25},"https:\u002F\u002Fwww.darkreading.com\u002Fcyber-risk\u002Ffbi-flagged-phishing-kit-kali365-expands-its-reach","fbi-flagged-phishing-kit-kali365-expands-its-reach-b67680","FBI-Flagged Phishing Kit Kali365 Expands Its Reach",[27,33],{"id":28,"name":29,"slug":30,"description":31,"color":32},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":34,"name":35,"slug":36,"description":37,"color":38},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[41,45,49],{"slug":42,"name":43,"problem":44},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":46,"name":47,"problem":48},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":50,"name":51,"problem":52},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]