Kali365

Kali365 is a phishing-as-a-service (PhaaS) platform first observed in 2026 that specializes in identity-focused phishing, most notably abuse of Microsoft OAuth 2.0 device authorization flow against Microsoft 365 and Entra ID users. The service is marketed largely through Telegram and lowers the barrier to entry for criminal affiliates by providing ready-made lures, templates, dashboards, victim tracking, and OAuth token-capture tooling. Kali365 is also referred to as K365 and has been associated with related branding including Octopi365 and Freedom365. Its best-documented tradecraft uses device-code phishing rather than direct credential theft. Operators initiate a legitimate device authorization request, present the victim with an attacker-generated code, and direct the victim to a genuine Microsoft login page. The victim completes normal authentication and often MFA, but the resulting authorization is granted to an attacker-controlled session. This yields OAuth access and refresh tokens that can provide persistent access to Microsoft 365 resources such as Outlook, OneDrive, SharePoint, and Teams, and can survive simple password resets until tokens, sessions, or related persistence are revoked. Kali365 has been described as a subscription criminal service with automation for lure generation, campaign management, token capture, and post-compromise workflows. Reported platform capabilities include built-in phishing templates, token vaulting, mailbox access, victim tracking, and infrastructure designed to blend with legitimate cloud services. Related reporting also describes panel variants supporting adversary-in-the-middle phishing, session and cookie abuse, contact harvesting, keyword monitoring, Microsoft Graph-based tenant reconnaissance, and business-email-compromise-oriented workflows. Targeting has expanded beyond Microsoft 365 into a broader multi-brand phishing operation impersonating enterprise identity, document-sharing, cloud-storage, email, and messaging services, including Okta, Google Workspace, Xerox DocuShare, LiveDrive, GMX, AWS-themed services, Mail.ru, Yandex Disk, Odnoklassniki, and MAX Messenger. In Microsoft-focused campaigns, Kali365 has targeted organizations in sectors including government, manufacturing, healthcare, and consulting, with reporting specifically noting U.S. organizations and broader activity across North America and Europe. Separate reporting links the same ecosystem to campaigns against Russian consumer messaging users through credential and one-time-code capture workflows. Kali365 is financially motivated and aligned with account takeover, fraud, business email compromise, reconnaissance, and data theft objectives. The platform exemplifies the productization of device-code phishing into a repeatable criminal service model that abuses legitimate authentication infrastructure, reduces reliance on fake login pages, and shifts post-compromise activity toward token-centric persistence and cloud account exploitation.