Tag: kali365

3 Attack Reports | 0 Vulnerabilities

Attack reports

From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook, Okta, Xerox DocuShare, and Other Services

A significant expansion of the Kali365 phishing-as-a-service operation has been observed, now targeting multiple platforms beyond Microsoft 365. The operator abuses OAuth 2.0 device authorization flows to bypass MFA and steal authentication tokens. Key discoveries include a live command-and-control…
mfa bypass
phishing-as-a-service
token theft
device code phishing
kali365
ekz infostealer
2026-06-02
max messenger
oauth 2.0 abuse
russian platforms
Published: June 2, 2026
Downloadable IOCs: 1

Device Code Phishing is an Evolution in Identity Takeover

Device code phishing attacks have exploded across the threat landscape, with new toolkits emerging weekly. This surge coincides with publicly released criminal toolkits and multiple phishing-as-a-service offerings like EvilTokens and Tycoon. Threat actors abuse the OAuth 2.0 device authorization gr…
credential theft
clickfix
microsoft 365
phishing-as-a-service
account takeover
tycoon 2fa
identity compromise
device code phishing
eviltokens
kali365
oauth abuse
2026-05-14
artokens
odx
Published: May 14, 2026
Downloadable IOCs: 0

Token Bingo: Don't Let Your Code be the Winner

In early April 2026, a large-scale device code phishing campaign targeted organizations across multiple sectors and regions, exploiting OAuth 2.0 Device Authorization Grant. Threat actors leveraged the Kali365 phishing-as-a-service platform, originating primarily from IP address 216.203.20[.]95. Th…
credential theft
microsoft 365
phishing-as-a-service
inbox rules
token theft
device code phishing
2026-04-25
kali365
oauth abuse
Published: April 25, 2026
Downloadable IOCs: 5
Click here to see more Attack Reports