Kali365Malware
Kali365 is a Phishing-as-a-Service (PHaaS) kit first observed in April 2026 that generates victim-targeted lures across multiple operating systems to induce users into copying and pasting actor-controlled commands for local execution. Kali365 incorporates on-demand device code generation and mirrors the copy-paste execution tradecraft associated with ClickFix.From MITRE ATT&CK
Last reported 2 days ago, by Huntress10 reports
ATT&CK techniques
6 of 23 · each with the sentence it comes from- T1098.005Device Registration
“Polled audience members voted sign-in address and new device registration as the top two signals to investigate first if token theft is suspected.”
- T1556.009Conditional Access Policies
“He points to Conditional Access Policies as a key prevention measure: "The vast majority of Microsoft environments do not need device code flow."”
- T1684Social Engineering
“Read more: ClickFix Explosion: Cross-Platform Social Engineering Turns Users Into Malware Installers”
- T1204.004Malicious Copy and Paste
“…ites to deliver malware via drive-by download techniques, often using fake CAPTCHA lures to trick users into executing code via malicious copy and paste (aka paste and run, ClickFix, fakeCAPTCHA).”
- T1218.002Control Panel
“Andrea walked through how the Kali365 control panel is an entire criminal ecosystem in a box, including AI features: "It's not just someone standing up a convincing login page, it's a whole ecosystem that helps an operator acquire infrastructure, collect authentication material,…”
- T1036Masquerading
“In July 2026 we most frequently observed it masquerading as PDF readers.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
10 reports, newest first · the exact sentence from each-
Unboxing Phishing Kits: Huntress Examines 3 Real Kits“Andrea walked through how the Kali365 control panel is an entire criminal ecosystem in a box, including AI features: "It's not just someone standing up a convincing login page, it's a whole ecosystem that helps an operator acquire infrastructure, collect authentication material,…”
-
Related Threat Context: Cut Time-to-Triage with Actionable Context for Every IOC“Use Case #1: Uncover Additional Kali365 Infrastructure with Related Threat Context”
-
How MSSPs Can Prove Their Value When “Nothing Happened”“ANY.RUN’s 2026 MSSP data shows frequent analysis of families such as ClickFix, Sneaky2FA, EvilTokens, EtherHiding, and Kali365.”
-
6 Months on Alert: Get H1 2026 Cyber Risk Report for SOCs and MSSPs“In ANY.RUN’s Interactive Sandbox, check suspicious URLs and monitor activity tagged as oauth-ms-phish, eviltokens, or kali365.”
-
Inside Knight Office, a New M365 AiTM Phishing Kit“Knight Office is yet another phishing kit that relies on token theft, with other phishing services like EvilTokens and Kali365 centering their services around AiTM (session tokens) and device code phishing (OAuth access tokens).”
-
Intelligence Insights: August 2026“… third device code phishing tool to make the top 10 in 2026, following the similarly-named (but unrelated) GraphRunner in May 2026, and Kali365 in June 2026.”
-
We Need to Talk About Device Code Phishing“And more recently, other popular PhaaS platforms like Kali365 are building device code phishing into their cybercrime product offerings.”
-
Intelligence Insights: June 2026“Kali365 makes its debut in 2nd place on our top 10 list.”
-
Inside Kali365, a Device Code Phishing Ecosystem“Inside Kali365, a Device Code Phishing Ecosystem”
-
How EvilTokens Turbocharges Old School Phishing with AI“Other kits like Tycoon2FA, BlueKit, and Kali365 are operating with similar levels of infrastructure and sophistication.”
Indicators in its reports
named in the reports above- railway[.]comin 1 report
- gl1nto.spiintforge[.]ruin 1 report
- reeemso.forwardbox.co[.]ukin 1 report
- chainlist[.]orgin 1 report
- hxxps://amber-22[.]com/api/metrics/run?event=pastedin 1 report
- amber-22[.]comin 1 report
- hxxp://195.10.205[.]212/Cpchain 1 report
- 195.10.205[.]212in 1 report
- 35613analytics[.]comin 1 report
- 104.37.188[.]94in 1 report
- 154.127.53[.]78in 1 report
- idoej[.]comin 1 report
- advancedplacyncement[.]vuin 1 report
- amstardmzsmc[.]vuin 1 report
- arandasoftzfdware[.]vuin 1 report
- avisoretentiunionllc[.]vuin 1 report
- capitalflwxinancialpartners[.]vuin 1 report
- certififiycationedge[.]vuin 1 report
- connectivnqzityltd[.]vuin 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.