Kali365 is a phishing-as-a-service operation that abuses OAuth 2.0 device authorization flows to bypass MFA protections and steal authentication tokens. It has expanded its scope to target a wide range of platforms including Microsoft Outlook, Okta SSO, Xerox DocuShare, and Russian services such as MAX Messenger, Mail.ru, Yandex Disk, and Odnoklassniki. The operation features a live command-and-control infrastructure and uses Telegram bots for exfiltrating credentials. A notable tactic includes impersonating MAX Messenger via fake prize-claim phishing flows. The campaign operates through a multi-tenant phishing platform with over 126 malicious hosts impersonating legitimate services, demonstrating a dual focus on Western enterprise and Russian consumer targets.

This phishing campaign enables attackers to bypass MFA by abusing OAuth 2.0 device authorization flows, resulting in theft of authentication tokens. Compromised tokens can allow unauthorized access to targeted accounts across multiple platforms, including enterprise and consumer services. The operation's use of Telegram bots for credential exfiltration and a large network of malicious hosts increases the scale and persistence of the threat. The targeting of both Western and Russian platforms broadens the potential victim base and impact.

No official patch or fix is available as this is a phishing-as-a-service operation exploiting OAuth 2.0 protocol misuse rather than a software vulnerability. Organizations should educate users about phishing risks, especially regarding OAuth device code authorization prompts. Monitoring for suspicious OAuth consent grants and unusual token activity is advised. Implementing conditional access policies that restrict OAuth app permissions and using security tools capable of detecting OAuth abuse can help mitigate risk. Since this is a social engineering and protocol abuse threat, technical controls combined with user awareness are key. Patch status is not yet confirmed — check vendor advisories of targeted platforms for any updates or guidance.