Tag: oauth 2.0 abuse

1 Attack Reports | 0 Vulnerabilities

Attack reports

From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook, Okta, Xerox DocuShare, and Other Services

A significant expansion of the Kali365 phishing-as-a-service operation has been observed, now targeting multiple platforms beyond Microsoft 365. The operator abuses OAuth 2.0 device authorization flows to bypass MFA and steal authentication tokens. Key discoveries include a live command-and-control…
mfa bypass
phishing-as-a-service
token theft
device code phishing
kali365
ekz infostealer
2026-06-02
max messenger
oauth 2.0 abuse
russian platforms
Published: June 2, 2026
Downloadable IOCs: 1
Click here to see more Attack Reports