Skip to main content
UnknownPublished Updated

NEW KALI365 PHAAS KIT BEING ABUSED IN THE WILD

Source CIRCL OSINT Feed

0

TLP:WHITE, disclosure is not limited

Description

NEW KALI365 PHAAS KIT BEING ABUSED IN THE WILD

Indicators of compromise

Domains 95

  • template-targetedorganisation-template.sharepoint-msviewer.comCustom Phishing Domains
  • data-doc-sfym.p-50ds7vs5.workers.devKnown Phishing Pages Hosted on Cloudflare Worker Domains
  • sync-link-z79k.bartlett-pamela.workers.devKnown Phishing Pages Hosted on Cloudflare Worker Domains
  • www.mediaplanung.bizPhaaS Operator Panel Domain
  • www.stpaulscathedralokc.orgPhaaS Operator Panel Domain
  • open-share-njlb.p-l4yg6fjb.workers.devKnown Phishing Pages Hosted on Cloudflare Worker Domains
  • sync-store-ur85.p-lboid22u.workers.devKnown Phishing Pages Hosted on Cloudflare Worker Domains
  • share-portal-r6le.p-deum4gog.workers.devKnown Phishing Pages Hosted on Cloudflare Worker Domains
  • cloud-link-j46j.p-zltii3tp.workers.devKnown Phishing Pages Hosted on Cloudflare Worker Domains
  • access-base-yz6o.p-uhv4e1ee.workers.devKnown Phishing Pages Hosted on Cloudflare Worker Domains

URLs 81

  • /dash/auth
  • /dash/auth/2fa
  • /dash/me
  • /dash/me/update
  • /dash/me/referral
  • /dash/me/2fa/setup
  • /dash/me/2fa/verify
  • /dash/me/2fa/disable
  • /dash/branding
  • /dash/stats

IP addresses 7

  • 157.230.53.233Fronted Portal IPs (subset)
  • 167.99.0.116Fronted Portal IPs (subset)
  • 162.243.166.119Fronted Portal IPs (subset)
  • 102.89.22.100Fronted Portal IPs (subset)
  • 159.203.163.96Fronted Portal IPs (subset)
  • 216.203.20.95Main Panel IPs (BP hosted infrastructure)
  • 199.91.220.111Main Panel IPs (BP hosted infrastructure)

Text 86

  • - New PhaaS kit has emerged called Kali365 - This kit has seen widespread abuse and leverages the OAuth device code registration flow - The kit is being distributed via Telegram and contains a fully featured mailbox scanning and phishing page creation features - AI enabled chatbot features assist with lure generation in the platform - Distinct from EvilTokens and sold at a lower price (~$250USD in BTC per Month)
  • NEW KALI365 PHAAS KIT BEING ABUSED IN THE WILD
  • kali365\-live\/1\.0\.0
  • (?i)(?:flow-open|note-access|drive-mail|store-open|mail-link|form-cloud|vault-cloud|page-sync|file-base|net-web|data-form|sync-vault|file-doc|access-file|data-doc|drive-edge|access-base|cloud-link|view-sync|share-portal|sync-store|open-share|app-edge|data-drive|flow-store|link-app|file-share|view-open|net-open|base-mail|file-drive|sync-link|core-portal|portal-cloud|sync-page|view-portal|vault-access|box-note|form-doc|cloud-access|hub-app|doc-open|sync-portal|file-sync|cloud-view|doc-note|hub-flow|page-mail|form-hub|portal-share|core-mail|vault-web|base-flow|secure-link|core-flow).*\.workers\.dev
  • (?i)[a-z]{5}-[a-z]{4}-[a-z0-9]{4}\.(?:mary-3fb|c-cmd509g3|c-qtkfck53|c-kzevzz5a|p-1razygxw|p-8kehah0a|p-b8eaz6oe|p-rrw76os2|royalbase3|p-l3bhkqec|p-y10utwre|p-qtlv10l7)\.workers\.dev
  • Authentication - Login
  • Authentication - 2FA verification
  • User / Profile - Get current user profile
  • User / Profile - Update profile
  • User / Profile - Get referral info

Comment 3

  • User agent string of the Kali365 mailbox GUI application
  • Kali365 V1 and V2 - Cloudflare Worker regex
  • Kali365 V3 - Cloudflare Worker regex

Http method 80

  • POST
  • POST
  • GET
  • POST
  • GET
  • POST
  • POST
  • POST
  • GET
  • GET

Community reviews

Loading reviews…