From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook, Okta, Xerox DocuShare, and Other Services

**Executive summary:** Arctic Wolf Labs documents active Kali365 phishing-as-a-service operations that abuse Microsoft’s OAuth 2.0 device authorization flow to capture persistent M365 tokens and run a multi-brand phishing infrastructure (126 hosts) including a targeted MAX Messenger account-takeover campaign; the report identifies a live C2 panel (panel.securehubcloud.com), Telegram-based credential exfiltration, content-based hunting fingerprints, and defensive recommendations.