03/06/2026
๐ง๐ต๐ฒ ๐๐๐ ๐ต๐ฎ๐ ๐ถ๐๐๐๐ฒ๐ฑ ๐ฎ ๐๐ฎ๐ฟ๐ป๐ถ๐ป๐ด ๐ฎ๐ฏ๐ผ๐๐ ๐ฎ ๐ฃ๐ต๐ถ๐๐ต๐ถ๐ป๐ด-๐ฎ๐-๐ฎ-๐ฆ๐ฒ๐ฟ๐๐ถ๐ฐ๐ฒ (๐ฃ๐ต๐ฎ๐ฎ๐ฆ) ๐ธ๐ถ๐ ๐๐ต๐ฎ๐ ๐ฏ๐๐ฝ๐ฎ๐๐๐ฒ๐ ๐ ๐๐ ๐ฎ๐ป๐ฑ ๐น๐ฒ๐๐ ๐ฎ๐๐๐ฎ๐ฐ๐ธ๐ฒ๐ฟ๐ ๐ด๐ฎ๐ถ๐ป ๐ฝ๐ฒ๐ฟ๐๐ถ๐๐๐ฒ๐ป๐ ๐ฎ๐ฐ๐ฐ๐ฒ๐๐ ๐๐ผ ๐๐ผ๐๐ฟ ๐ ๐ถ๐ฐ๐ฟ๐ผ๐๐ผ๐ณ๐ ๐ฏ๐ฒ๐ฑ ๐ฒ๐ป๐๐ถ๐ฟ๐ผ๐ป๐บ๐ฒ๐ป๐ - ๐ป๐ผ ๐ฝ๐ฎ๐๐๐๐ผ๐ฟ๐ฑ ๐ฟ๐ฒ๐พ๐๐ถ๐ฟ๐ฒ๐ฑ.
The PhaaS kit, Kali365, was first detected in April 2026. It puts advanced attack infrastructure within reach of low-skill threat actors, including AI-generated lures, automated templates, real-time target tracking, and token-capture tools.
๐๐ผ๐ ๐๐ ๐ช๐ผ๐ฟ๐ธ๐
Step 1: Attackers send a phishing email impersonating trusted cloud services.
Step 2: The email directs the target to a legitimate Microsoft verification page, where they are prompted to enter a device code included in the message.
Step 3: By doing so, they unknowingly authorize the attacker's device, handing over OAuth access and refresh tokens.
Step 4: The attacker gains persistent access to Microsoft 365 services, including Outlook, Teams, and OneDrive, without a password or MFA challenge.
๐ง๐ผ ๐ฟ๐ฒ๐ฑ๐๐ฐ๐ฒ ๐ฒ๐
๐ฝ๐ผ๐๐๐ฟ๐ฒ, ๐๐ต๐ฒ ๐๐๐ ๐ฟ๐ฒ๐ฐ๐ผ๐บ๐บ๐ฒ๐ป๐ฑ๐ ๐๐ต๐ฎ๐ ๐ผ๐ฟ๐ด๐ฎ๐ป๐ถ๐๐ฎ๐๐ถ๐ผ๐ป๐:
โ๏ธRestrict or block device code flow via conditional access policies
โ๏ธAudit existing device code usage before making policy changes
โ๏ธBlock authentication transfer between devices
โ๏ธExclude emergency access accounts to prevent lockouts
If your business has been impacted, report it to the Internet Crime Complaint Center (IC3) at http://www.ic3.gov
Email remains a top entry point for cyberattacks. Check whether your domain is protected against email impersonation: https://eu1.hubs.ly/H0vTqBW0
