--- title: FBI-Flagged Phishing Kit Kali365 Expands Beyond Microsoft 365 description: Kali365, a phishing service bypassing MFA, now targets AWS and Russian platforms, posing a growing cybersecurity threat. canonical_url: https://codekeeper.co/ticker/kali365-phishing-service-expands-targets --- # FBI-Flagged Phishing Kit Kali365 Expands Beyond Microsoft 365 Kali365, a phishing service bypassing MFA, now targets AWS and Russian platforms, posing a growing cybersecurity threat. ![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png) By Content Team Jun 3, 2026 Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkali365-phishing-service-expands-targets%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkali365-phishing-service-expands-targets%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkali365-phishing-service-expands-targets%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkali365-phishing-service-expands-targets%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkali365-phishing-service-expands-targets%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkali365-phishing-service-expands-targets%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg) ON THIS PAGE ### Want more insights like this? Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox. By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) . Kali365, a phishing-as-a-service platform the FBI warned about on 21 May 2026, has grown far more dangerous. Originally built to bypass MFA on Microsoft 365 accounts, it now impersonates AWS, Okta SSO, Xerox DocuShare, Germany's GMX, and a range of Russian platforms — Mail.ru, Yandex Disk, Odnoklassniki and MAX Messenger. MAX Messenger is a Russian state-backed app the government has promoted as the country's national messaging service, reporting over 110 million registered users and more than 80 million daily active users as of April 2026. Arctic Wolf researchers mapped 126 distinct malicious hosts running the same kit between 6 and 27 May. Kali365 abuses OAuth 2.0 device authorization: the attacker starts the login, then tricks the victim into approving it — so MFA is satisfied by the legitimate user and never blocks the theft. At least 14 device code phishing kits are now circulating, including Tycoon2FA, Venom and CYB3R, and the threat is accelerating. Defenders should restrict or disable device code flow via Conditional Access where it isn't needed, and block authentication-transfer policies. Arctic Wolf flags panel[.]securehubcloud[.]com as high-confidence C2, recommends blocking *.attachedfile[.]com as a unit, and identifies the kit by its "Preparing your secure document…" page. **Source:** [Dark Reading](https://www.darkreading.com/cyber-risk/fbi-flagged-phishing-kit-kali365-expands-its-reach) Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkali365-phishing-service-expands-targets%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkali365-phishing-service-expands-targets%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkali365-phishing-service-expands-targets%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkali365-phishing-service-expands-targets%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkali365-phishing-service-expands-targets%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fkali365-phishing-service-expands-targets%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg) ![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp) Have questions about protecting your software? Our escrow experts are standing by to help. [Book a free demo](https://codekeeper.co/book-a-demo) YOU MAY ALSO LIKE [FortiBleed Campaign Linked to Inc and Lynx Ransomware Gangs Aug 12, 2026](https://codekeeper.co/ticker/fortibleed-attack-ransomware-nextcloud-exploit) [Sheffield Hospitals Charity Supporters Hit in Beacon CRM Data Breach Aug 11, 2026](https://codekeeper.co/ticker/sheffield-hospitals-charity-data-breach-alert) [Vulnerabilities Hackers Are Actively Exploiting a Critical WordPress Flaw — Update Now Sep 25, 2026](https://codekeeper.co/ticker/wordpress-vulnerability-cve-2026-87902) [Silent Ransom Group Targets US Law Firms with Rapid Extortion Attacks Aug 12, 2026](https://codekeeper.co/ticker/silent-ransom-targets-us-firms-2026)