FBI-Flagged Phishing Kit Kali365 Expands Its Reach

Kali365, a phishing-as-a-service kit notable for device-code phishing that can bypass MFA, has expanded from Microsoft 365 targeting to a broad set of enterprise and Russian consumer platforms (including MAX Messenger), with researchers identifying active C2 infrastructure and dozens of malicious hosts; vendors and the FBI warn organizations to harden controls and increase user awareness as multiple similar kits proliferate.