Date: 07/22/2026
Severity: High
Summary
Kali365 is a phishing-as-a-service (PhaaS) kit targeting U.S. organizations through Microsoft device code phishing. Instead of stealing passwords via fake login pages, it tricks victims into authorizing an attacker-controlled device on a legitimate Microsoft authentication page, allowing attackers to obtain OAuth access and refresh tokens for persistent access to Microsoft 365 accounts, email, documents, and cloud resources while evading traditional phishing detection.
Indicators of Compromise (IOC) List
Domains/URLs | bluefoodtruths.xyz flexiscalesystems.de guardedwebsolutions.de proforcstaffing.com reputationboosters.de guardextion.online prowebsitemakers.de onlinebrandinghub.de onsite-developments.net functionalityfirst.de buildyouronlineidentity.de flexievolve.de cloud-microsoft-drive-for-business.workers.dev onlineidentityperfection.de guardwebsolutions.de securedecisionmaking.de modernwebbalance.de marketadaptabletech.de waschmaschinenmarkt.de txatvrk.net hbaknoxvillecom.top brandswithintegrity.de turnideastoresults.de wellpults.com navigatingdigitalchange.de qualityfirstonline.de brandtrustmasters.de theconsistencyfactor.de reliablebusinesstech.de performancereputation.de dewdhurstlobl.com securedecisionmakers.de scalableadapt.de trustinbrands.de |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "scalableadapt.de" or url like "scalableadapt.de" or siteurl like "scalableadapt.de" or domainname like "functionalityfirst.de" or url like "functionalityfirst.de" or siteurl like "functionalityfirst.de" or domainname like "hbaknoxvillecom.top" or url like "hbaknoxvillecom.top" or siteurl like "hbaknoxvillecom.top" or domainname like "marketadaptabletech.de" or url like "marketadaptabletech.de" or siteurl like "marketadaptabletech.de" or domainname like "onlineidentityperfection.de" or url like "onlineidentityperfection.de" or siteurl like "onlineidentityperfection.de" or domainname like "performancereputation.de" or url like "performancereputation.de" or siteurl like "performancereputation.de" or domainname like "guardedwebsolutions.de" or url like "guardedwebsolutions.de" or siteurl like "guardedwebsolutions.de" or domainname like "reliablebusinesstech.de" or url like "reliablebusinesstech.de" or siteurl like "reliablebusinesstech.de" or domainname like "dewdhurstlobl.com" or url like "dewdhurstlobl.com" or siteurl like "dewdhurstlobl.com" or domainname like "flexievolve.de" or url like "flexievolve.de" or siteurl like "flexievolve.de" or domainname like "guardextion.online" or url like "guardextion.online" or siteurl like "guardextion.online" or domainname like "onlinebrandinghub.de" or url like "onlinebrandinghub.de" or siteurl like "onlinebrandinghub.de" or domainname like "buildyouronlineidentity.de" or url like "buildyouronlineidentity.de" or siteurl like "buildyouronlineidentity.de" or domainname like "onsite-developments.net" or url like "onsite-developments.net" or siteurl like "onsite-developments.net" |
Detection Query 2 : | domainname like "theconsistencyfactor.de" or url like "theconsistencyfactor.de" or siteurl like "theconsistencyfactor.de" or domainname like "securedecisionmakers.de" or url like "securedecisionmakers.de" or siteurl like "securedecisionmakers.de" or domainname like "wellpults.com" or url like "wellpults.com" or siteurl like "wellpults.com" or domainname like "modernwebbalance.de" or url like "modernwebbalance.de" or siteurl like "modernwebbalance.de" or domainname like "navigatingdigitalchange.de" or url like "navigatingdigitalchange.de" or siteurl like "navigatingdigitalchange.de" or domainname like "waschmaschinenmarkt.de" or url like "waschmaschinenmarkt.de" or siteurl like "waschmaschinenmarkt.de" or domainname like "securedecisionmaking.de" or url like "securedecisionmaking.de" or siteurl like "securedecisionmaking.de" or domainname like "brandswithintegrity.de" or url like "brandswithintegrity.de" or siteurl like "brandswithintegrity.de" or domainname like "proforcstaffing.com" or url like "proforcstaffing.com" or siteurl like "proforcstaffing.com" or domainname like "trustinbrands.de" or url like "trustinbrands.de" or siteurl like "trustinbrands.de" or domainname like "reputationboosters.de" or url like "reputationboosters.de" or siteurl like "reputationboosters.de" or domainname like "flexiscalesystems.de" or url like "flexiscalesystems.de" or siteurl like "flexiscalesystems.de" or domainname like "cloud-microsoft-drive-for-business.workers.dev" or url like "cloud-microsoft-drive-for-business.workers.dev" or siteurl like "cloud-microsoft-drive-for-business.workers.dev" or domainname like "bluefoodtruths.xyz" or url like "bluefoodtruths.xyz" or siteurl like "bluefoodtruths.xyz" or domainname like "prowebsitemakers.de" or url like "prowebsitemakers.de" or siteurl like "prowebsitemakers.de" or domainname like "turnideastoresults.de" or url like "turnideastoresults.de" or siteurl like "turnideastoresults.de" or domainname like "brandtrustmasters.de" or url like "brandtrustmasters.de" or siteurl like "brandtrustmasters.de" or domainname like "guardwebsolutions.de" or url like "guardwebsolutions.de" or siteurl like "guardwebsolutions.de" or domainname like "txatvrk.net" or url like "txatvrk.net" or siteurl like "txatvrk.net" or domainname like "qualityfirstonline.de" or url like "qualityfirstonline.de" or siteurl like "qualityfirstonline.de" |
Reference:
https://any.run/cybersecurity-blog/kali365-phishing-targeting-us/#kali365-attack-overview-22219