Netcrook
#Kali365
When a Real Microsoft Login Becomes the Trap Door
A phishing kit tied to Kali365 is abusing Microsoft’s device-code sign-in path, showing how legitimate authentication can be twisted into a cloud access problem.
When a Legitimate Microsoft Login Becomes the Attack
A reported campaign tied to Kali365 shows how Microsoft device login can be twisted into an OAuth token grab, turning an ordinary sign-in step into a cloud security problem for targeted U.S. firms.
Phishing Kits Are Learning to Borrow Trust, Not Just Brands
Kali365 appears to be expanding a phishing playbook built around identity workflows, showing how token theft and login abuse can travel across very different services.
Phishing Kits Are Learning to Live on Stolen Sessions, Not Just Stolen Passwords
Kali365 is reported to have widened its targeting from Microsoft 365 token theft to Okta SSO and MAX Messenger, a sign that commoditized phishing is shifting toward reusable session abuse.
When a Real Microsoft Login Becomes the Trap
A phishing service built around OAuth device code flow shows how attackers can turn a legitimate sign-in path into token theft, session hijacking, and MFA bypass.
When the Login Code Becomes the Weapon: Kali365 and the New Cloud Phish
A phishing-as-a-service platform is turning Microsoft’s device-code sign-in into a turnkey path for token theft, session hijacking, and quieter cloud compromise.
When the Password Is Not the Prize: The Microsoft 365 Token Grab Hidden Inside Kali365
A phishing kit linked to Telegram distribution is pushing attackers toward session theft, turning a successful sign-in into a longer-lived foothold inside cloud accounts.
When Login Flows Become the Payload: The New Microsoft 365 Phishing Trap
A reported phishing service named Kali365 points to a harder problem than stolen passwords: cloud identity abuse that can ride on legitimate OAuth and device-code sign-in paths.