Kali365: the phishing-as-a-service market and the FBI warning

What Kali365 is, and why the FBI took an interest

Kali365 is a phishing-as-a-service platform aimed at Microsoft 365. The FBI alert states it was first seen in April 2026 and distributed primarily over Telegram. A subscriber gets AI-generated lures, ready-made campaign templates, a dashboard for tracking targets in real time, and OAuth token capture. The result is durable access to the victim environment, obtained without capturing a password and without breaking the second factor.

Two things tend to blur together in press coverage, and they are worth separating. The technique, abuse of the OAuth 2.0 Device Authorization Grant flow, is not new and was documented long before Kali365 existed. We walk through it step by step in a separate analysis. What is new is the product: the same technique wrapped in a subscription, with customer support, a template library and a panel, sold to someone who could not implement it themselves.

That distinction has operational consequences. Treat Kali365 as a campaign and you go looking for one group, one set of addresses and one lure style. Treat it as a platform and you assume from the outset that there are many independent operators sharing code and infrastructure while differing in target, language and calendar. The second view describes what actually shows up in logs far better.

What the FBI actually said, when, and to whom

The alert carries the number I-052126-PSA and the date 21 May 2026. It is a Public Service Announcement, a format addressed to a general audience of public institutions, businesses and individuals, rather than a closed bulletin for one sector. The reporting channel remains IC3, the Internet Crime Complaint Center. The text is short and, for this format, unusually specific.

• Name and date — the platform is identified as Kali365, first observed in April 2026
• Distribution channel — sales and support run primarily through Telegram
• Effect of the attack — capture of Microsoft 365 access tokens and MFA bypass without intercepting the user credentials
• Scope of access — the attacker reaches Outlook, Teams and OneDrive with no password and no further MFA challenge
• What a subscriber gets — AI-generated lures, campaign templates, real-time target tracking dashboards and OAuth token capture
• Recommendations — a Conditional Access policy blocking the device code flow, an audit of existing use of that flow, and exempting only break-glass accounts

What the alert leaves out is just as telling. The FBI publishes no list of addresses or domains, names no particularly exposed sectors and attributes the platform to no specific group. Under an affiliate model an indicator list ages faster than it can reach its readers, and the target profile belongs to the affiliate rather than to the platform. So the agency communicates what stays stable: the mechanism, and the control that switches it off.

What the phishing-as-a-service market looks like in 2026

Kali365 is not an isolated case but another entry in a catalogue that has been growing for years. Flare analysed 8,627 listings for phishing kits, collected over a year from forums, Telegram and open sources. More than half of them, 54.1% precisely, offered a finished service rather than code to stand up yourself. The market has moved from "buy a script and host it" to "buy access and log into the panel".

The channel split says more than the headline count. Deep web forums carried 58.8% of the listings, open sources 19.4%, Telegram 14.1%, and the dark web only 7.7%. The picture of phishing tooling changing hands exclusively in a hidden corner of the network reachable through Tor is simply out of date. That matters for monitoring: threat intelligence narrowed to .onion markets misses most of the phenomenon. Watching this layer is the job of threat exposure management tooling such as Flare.

Not everything advertised in those channels exists at all. In the same sample, 36.3% of entries were classified as real threats with high confidence, 20.5% as probably real, and 22.0% as scams or fake listings. A fifth of this market, in other words, robs its own customers. That explains why kit names multiply faster than working platforms do, and why detection built around a name is brittle.

Platform, infrastructure and operator are three separate layers, and a defender mostly sees traces of the last two. Detection built on the platform name aims at the one layer that leaves nothing measurable behind.

The affiliate model: who is really running the campaign against you

Under an affiliate model the platform operator attacks nobody. They maintain the code and the panel, refresh templates as the identity provider changes, and charge for access. The subscriber runs the campaign: picks the target, uploads a recipient list, chooses a template and collects the results. This division of labour is not new. Researchers from TNO, Eindhoven University of Technology and Delft University of Technology documented it in the Dutch phishing-kit market, showing plainly that ready-made tooling lowers the threshold for a criminal entrepreneur. Kali365 is the same phenomenon one layer up: today you do not even have to deploy the kit.

• One platform, many calendars — two campaigns from the same infrastructure can be weeks apart and share nothing but the tooling vendor
• One platform, many skill levels — the same kit serves a crew staging ransomware and a lone fraudster chasing a single transfer
• Shared code, different lures — copy comes from a generator and can be unique per recipient, so content-based matching fails
• Shared structure, different domains — what repeats is the page layout, the URL path and the redirect sequence, not the hostname
• Monetisation outside the platform — a hijacked mailbox is often resold, so a second entry need not mean the same attacker returned

The conclusion is inconvenient: attribution to a platform name has little operational value. Knowing the lure came from Kali365 tells you nothing about who sent it, why, or whether they will be back. What has value is a description of behaviour: how delivery looked, what was done with the token, and what left the building.

The barrier to entry, and what it changes for a mid-sized company

Until recently, an attack ending in OAuth token theft demanded three things at once: an understanding of authentication flows, the ability to stand up and maintain infrastructure, and the patience to write a convincing lure in the victim language. The PhaaS model removes each of those barriers separately. The platform backend handles the flow. The operator supplies and rotates the infrastructure. A generator writes the lure.

Removing those barriers does not make the attack harder to defend against. It makes there be more of them, and that is the real change in risk profile for a mid-sized company. It used to be reasonable to assume that an attacker technically capable of this would pick a target worth the effort. Under a subscription model that calculation breaks down, because the marginal cost of one more campaign is close to zero: hitting a 150-person firm costs the affiliate exactly what hitting a corporation costs.

The vector side of this is stable in the data. Microsoft reports that 28% of the breaches it analysed began with phishing or social engineering, ahead of unpatched web-facing assets (18%) and exposed remote access services (12%). The same report puts the growth in identity attacks at 32% during the first half of 2025, with more than 97% of them being password attacks. Generative AI adds lure quality on top: phishing run with it is, by Microsoft measurement, three times more effective than hand-written campaigns.

The Polish picture looks much the same. CERT Polska registered 260,783 unique incidents during 2025, of which 78,391 were phishing, roughly 30% of everything recorded. Neither size nor sector protects an organisation from this category.

Why takedowns do not settle the matter

The institutional response goes beyond warnings. In September 2025 the Microsoft Digital Crimes Unit, working with Cloudflare and US law enforcement, seized 338 domains belonging to RaccoonO365, a platform selling kits aimed at Microsoft 365; the case led to the arrest of the person running the operation. In March 2026 the same unit seized 330 active domains from the Tycoon 2FA platform, its first takedown coordinated through a Europol programme. Earlier, in April 2024, an international investigation coordinated by Europol dismantled LabHost, a phishing-as-a-service platform sold on a monthly subscription that facilitated phishing against customers of hundreds of financial institutions.

Three such actions in under two years show both the scale of the problem and the limits of this response. Seizing domains shuts down an instance, not the model: the code, the recipient lists and the customers move to the next platform, and the name changes faster than the rules in a mail gateway. Which is why the FBI alert ends with a configuration recommendation rather than an indicator list.

Indicators and detection on the SOC side

This is the real reason to read PhaaS warnings at all. Indicators from an advisory have a short shelf life, but the patterns behind them last. Start, though, with the question most teams answer too late: do you have anything to search in the first place.

What you do not log, you will not find

Before writing the first query, check whether the sources below are collected and for how long they are kept. An affiliate campaign is often recognised only weeks later, and the default refresh token max inactive time in Microsoft Entra ID is 90 days. Shorter retention means the question "when did this start" will go unanswered.

• Microsoft Entra sign-in logs — interactive and non-interactive; the latter are skipped most often, and they are where token replay shows
• Entra audit log — application consent grants, service principal registrations, device registrations and authentication method changes
• Exchange Online activity — inbox rules, forwarding, bulk file downloads, outbound sending
• Mail telemetry — envelope and header sender, SPF, DKIM and DMARC verdicts, plus URLs from bodies and attachments including those lifted out of QR codes
• Link click events — especially the ones where a user continued past the warning page
• DNS and proxy — queries to freshly registered domains and to the edge services PhaaS uses for disposable pages
• Retention — matched to the session lifecycle rather than to tool defaults; below 90 days you lose the beginning of the story

Infrastructure indicators

PhaaS infrastructure indicators fall into two classes with very different shelf lives. Addresses and domain names are disposable. The structure, meaning the way that infrastructure comes into being, repeats between campaigns and between platforms, and it is the structure that belongs in a rule.

• Domain age — a lure domain is typically hours to days old; age is a stronger signal here than reputation
• Certificate issued just before the campaign — a bulk domain-validated certificate created hours before the first send
• Edge services as lure hosting — disposable subdomains on edge function platforms and tunnelling services, with no history in your organisation
• Repeating URL path — the same directory and parameter scheme across unrelated campaigns despite different domains
• Redirect chain — two or three hops through shorteners and well-reputed domains before traffic lands on the real page
• A filter page in front of the lure — a "verification" screen whose job is to shed analysis automation and sandboxes
• Envelope sender diverging from header sender while SPF passes — platform campaigns ride on someone else properly configured sending infrastructure

Affiliate patterns

Affiliate patterns are the signals telling you that the other side is a platform customer rather than the tool author. They earn their keep by letting you connect events that separately look like three small oddities from three different queues.

• Bulk sending from one hijacked account — dozens or hundreds of messages in a short window, to recipients outside any prior correspondence
• An inbox rule created within minutes of an unusual sign-in — typically moving mail containing "security", "alert", "sign-in" or "phish" to deleted items or archive
• Consent granted to an application nobody in the organisation recognises — mail or file permissions given to an app outside the approved inventory
• A new authentication method registered shortly after a sign-in from a new network — the persistence step that survives a password reset
• The same client fingerprint across several users — one rare application ID or user agent appearing for people with nothing in common
• A second entry after a gap — a sign-in to the same account from an unrelated network days later, the signature of resold access

// Aimed at phishing-as-a-service infrastructure and affiliate behaviour rather
// than at the device code flow itself. Tune every threshold to your own tenant.

// 1. Lure hosting. Inbound mail pointing at throwaway edge or tunnelling hosts,
//    plus URLs lifted out of QR codes. Rarity does the work: a domain seen once,
//    delivered to a handful of people, is the shape of a rotating PhaaS front end.
let lookback = 14d;
let edgeHosts = dynamic(["workers.dev", "pages.dev", "trycloudflare.com", "r2.dev",
                         "web.app", "firebaseapp.com", "netlify.app", "vercel.app",
                         "onrender.com", "glitch.me", "ngrok-free.app", "ngrok.io"]);
EmailEvents
| where Timestamp > ago(lookback) and EmailDirection == "Inbound"
| join kind=inner (
    EmailUrlInfo
    | where Timestamp > ago(lookback)
    | project NetworkMessageId, UrlDomain, UrlLocation
) on NetworkMessageId
| where UrlLocation == "QRCode" or UrlDomain has_any (edgeHosts)
| summarize Messages = count(),
            Recipients = dcount(RecipientEmailAddress),
            SenderDomains = make_set(SenderMailFromDomain, 10),
            Delivered = countif(DeliveryAction == "Delivered"),
            FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
        by UrlDomain, UrlLocation
| where Delivered > 0 and Recipients <= 25
| order by FirstSeen desc

// 2. Someone clicked through the Safe Links warning and a session appeared right
//    after. Neither half deserves an alert on its own; the pair does. Needs the
//    Defender tables and Entra sign-in logs in one workspace.
let clicks = UrlClickEvents
    | where Timestamp > ago(7d)
    | where ActionType == "ClickAllowed" or IsClickedThrough
    | project ClickTime = Timestamp, Upn = tolower(AccountUpn), Url, ThreatTypes;
clicks
| join kind=inner (
    SigninLogs
    | where TimeGenerated > ago(7d) and ResultType == 0
    | project SignInTime = TimeGenerated, Upn = tolower(UserPrincipalName),
              IPAddress, Asn = AutonomousSystemNumber, AppDisplayName, UserAgent
) on Upn
| where SignInTime between (ClickTime .. ClickTime + 30m)
| project Upn, ClickTime, Url, ThreatTypes, SignInTime, IPAddress, Asn,
          AppDisplayName, UserAgent
| order by ClickTime desc

// 3. The affiliate playbook once a mailbox falls: a rule that buries security
//    mail. UncommonForUser is what keeps this off ordinary housekeeping.
CloudAppEvents
| where Timestamp > ago(30d)
| where Application has "Exchange"
| where ActionType in ("New-InboxRule", "Set-InboxRule", "UpdateInboxRules")
| extend Raw = tostring(RawEventData)
| where Raw has_any ("security", "alert", "sign-in", "signin", "phish",
                     "protection", "quarantine", "helpdesk")
| where Raw has_any ("DeletedItems", "Junk", "Archive", "RSS", "MarkAsRead", "Delete")
| project Timestamp, AccountDisplayName, AccountObjectId, ActionType,
          IPAddress, Isp, CountryCode, UserAgent, UncommonForUser
| order by Timestamp desc

// 4. Consent handed to an application nobody recognises. Diff AppId against your
//    approved application inventory before triaging anything here.
AuditLogs
| where TimeGenerated > ago(30d)
| where OperationName in ("Consent to application", "Add OAuth2PermissionGrant",
                          "Add delegated permission grant",
                          "Add app role assignment grant to user")
| where Result == "success"
| extend Actor = tostring(InitiatedBy.user.userPrincipalName),
         ActorIp = tostring(InitiatedBy.user.ipAddress),
         AppName = tostring(TargetResources[0].displayName),
         AppId = tostring(TargetResources[0].id)
| summarize Grants = count(), Consenters = dcount(Actor),
            Who = make_set(Actor, 20), Ips = make_set(ActorIp, 20),
            FirstSeen = min(TimeGenerated)
        by AppName, AppId, OperationName
| order by FirstSeen desc

// 5. Affiliate reuse. A client application that shows up for a few unrelated
//    people this week and for nobody in the weeks before is a shared-toolkit
//    fingerprint, not a shared job function.
let baseline = SigninLogs
    | where TimeGenerated between (ago(30d) .. ago(7d))
    | summarize BaselineUsers = dcount(UserPrincipalName) by AppId;
SigninLogs
| where TimeGenerated > ago(7d) and ResultType == 0
| summarize Users = dcount(UserPrincipalName), Who = make_set(UserPrincipalName, 20),
            Asns = make_set(AutonomousSystemNumber, 10), Signins = count()
        by AppId, AppDisplayName
| join kind=leftouter (baseline) on AppId
| where isnull(BaselineUsers) or BaselineUsers <= 2
| where Users between (2 .. 15)
| project AppDisplayName, AppId, Users, Who, Asns, Signins, BaselineUsers
| order by Users desc

Telling signal from noise

Every query above will return rows in a healthy environment too, in its raw form. The difference between a detection and an alert generator is what you do with them next.

• Count rarity, not presence — edge services and shorteners have legitimate uses; what is alarming is a domain appearing for the first time and only for a handful of recipients
• Correlate two worlds — a click alone is not an incident and neither is a sign-in; "a click, then a session from a new network within half an hour" is
• Build an inventory of known applications — without a list of approved IDs the consent query will keep returning integrations you deployed yourself
• Separate a job role from a shared tool — a whole sales team on the same plugin is a business pattern; five unrelated people on the same rare client is an attack pattern
• Establish what is normal before deciding what is suspicious — two weeks of baseline for flows, applications and egress networks saves months of tuning
• Record your dismissals — an exception without a review date turns into a permanent blind spot

Target profile: who affiliates pick first

The platform is sector-agnostic; every Microsoft 365 tenant is a target. The choice belongs to the affiliate and follows whatever can be cashed out or resold quickly. Market data points the same way: among campaigns aimed at a single brand, Microsoft and Office 365 accounted for 21.4% of listings, behind only cryptocurrency at 53.9%. A Microsoft 365 account is attractive not in itself but as the key to correspondence, files and identity in whatever comes next.

• Financial and accounting services — the shortest path from a hijacked mailbox to a changed account number in a thread already under way
• Manufacturing and logistics — deadline pressure, a dispersed supply chain, and correspondence where an invoice attachment raises nothing
• Healthcare — sensitive data, high downtime cost and a regulatory response clock that punishes late detection
• Government and public sector — politically sensitive mailboxes and correspondence subject to public-records disclosure
• Professional services and IT — one compromise yields privileged visibility into many client environments at once
• Education and research — large user populations, federated identity and thin monitoring outside working hours

The order on that list comes from economics, not from technical weakness. All of these organisations run the same identity platform on the same defaults. What separates them is how quickly a hijacked mailbox turns into money.

What to do when an indicator fires

The full token-compromise response procedure, split by role and time frame, is in the runbook in our VENOM campaign analysis. What follows is the short decision path for the analyst on duty, before that procedure starts.

That last point is the one that closes the case for longer than a week. The recommendation in the FBI alert, a Conditional Access policy blocking the device code flow, an audit of existing use of that flow, and exempting only break-glass accounts, does not depend on what the platform will be called next quarter.

Frequently asked questions

In closing

The FBI warning about Kali365 is worth attention not because of this one platform but because of what its existence says about the market. Session hijacking has stopped being a skill and become a feature in somebody else panel. That does not change how hard the defence is; it changes how many organisations have to take it on. The answer is not another indicator list but two configuration decisions, a complete set of logs, and behaviour-based detection. The delivery channel itself remains ordinary phishing, which we sort out in our guide to the types of phishing; you can test your team against it with social engineering simulations.

Once an attack becomes a service, it stops selecting victims by difficulty and starts selecting them by return. For a defender that means the question "are we interesting enough to be worth someone time" has lost its meaning. What counts now is whether you can see the trace a platform customer leaves behind.