The Kali365 phishing-as-a-service (PhaaS) platform has significantly expanded its operational scope, moving beyond Microsoft 365 token theft to target Okta single sign-on (SSO) environments and Russia’s rapidly growing MAX Messenger platform.
New threat intelligence reveals a more mature, multi-brand phishing ecosystem with centralized infrastructure, real-time token monitoring, and geographically targeted campaigns.
Previously documented for abusing Microsoft’s OAuth 2.0 device authorization flow, Kali365 enables attackers to capture Entra ID access tokens without stealing credentials.
Instead of harvesting usernames and passwords, the attacker tricks victims into completing a legitimate device login flow.
Once authenticated, tokens are issued directly to the attacker’s application, effectively bypassing multi-factor authentication and granting persistent access to enterprise environments.
Recent analysis shows that the same operator has evolved this technique into a broader phishing campaign.
Researchers uncovered a live command-and-control (C2) panel hosted on securehubcloud domains, where attackers monitor token capture status in real time.
The phishing pages continuously poll the backend infrastructure, confirming when a victim completes authentication and when access tokens are successfully issued.
Infrastructure pivoting using TLS certificate fingerprints and HTTP response signatures revealed a cluster of 126 malicious hosts operating the same phishing kit.
These domains impersonate a wide range of services, including Okta SSO portals, Microsoft Outlook, AWS-style endpoints, and enterprise platforms like Xerox DocuShare.
In parallel, the campaign heavily targets Russian digital services such as Mail.ru, Yandex Disk, and Odnoklassniki, indicating deliberate regional targeting.
One of the most notable developments is Kali365 shift toward consumer messaging platforms, particularly MAX Messenger.
Launched in 2025 and backed by the Russian government, MAX has grown rapidly to over 110 million users. Attackers are now exploiting this user base through a dedicated phishing kit disguised as a prize verification workflow.
In this attack, victims are prompted to enter their Russian phone number, after which they receive a legitimate one-time password (OTP) from MAX.
According to Arctic Wolf, the phishing page then tricks users into submitting the OTP and, if enabled, their two-factor authentication password. This allows attackers to fully compromise accounts in a single interaction, gaining access to messages, contacts, and stored data.
Querying that fingerprint against passive host-response telemetry surfaced not only the three *.securehubcloud[.]com subdomains we already had (api., boss., and panel.), but also their hosting IPs and – critically – a recurring page-title fingerprint: “K365 Control.”
Credential exfiltration is automated through an embedded Telegram bot, identified as “NovosibyrskyMoneyBot,” which receives stolen data in real time.
This integration highlights the operational efficiency of the campaign, combining phishing delivery, credential harvesting, and data exfiltration into a seamless workflow.
Additional tracking mechanisms, including embedded pixels, suggest the operator is measuring campaign performance, consistent with affiliate-driven PhaaS models.
The words “novosibirsk” (Novosibirsk is a city in Russia) + “money” + “sova” (owl) in the account name, combined with the fake prize claim social engineering trick, fits a long-running scam genre that has been active on Telegram for years.
The propagation model further amplifies the threat. Once a MAX account is compromised, attackers use it to distribute phishing links to the victim’s contacts, mimicking trusted communication patterns.
This creates a self-sustaining infection loop similar to long-standing Telegram-based scams but adapted to a new platform with a massive user base.
The reuse of consistent HTML templates, JavaScript polling logic, and identifiable response signatures across all observed hosts indicates a centralized backend supporting multiple phishing fronts.
Overall, the expansion of Kali365 demonstrates how modern PhaaS operations are evolving beyond enterprise credential theft into hybrid campaigns targeting both corporate identity systems and high-volume consumer platforms.
This reinforces the assessment that Kali365 operates as a scalable, multi-tenant phishing platform rather than isolated campaigns.
The combination of OAuth abuse, real-time infrastructure, and cross-platform targeting presents a growing challenge for defenders, particularly as these kits continue to lower the barrier to entry for less sophisticated threat actors.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…