Kali365 Phishing-as-a-Service: FBI Warns of New M365 Credential Theft Tool

Got a question or comment? Message us here!

The FBI is warning about Kali365, a new phishing‑as‑a‑service tool designed to steal Microsoft 365 credentials and enable account takeovers at scale. In this episode, we break down how it works, why it’s so effective, and what your SOC can do right now to detect and defend against it.

 🎧 Tune in now at secureafpodcast.com

Support the show

Watch full episodes at youtube.com/@aliascybersecurity.
Listen on Apple Podcasts, Spotify and anywhere you get your podcasts.

Episode Transcript

SPEAKER_00 (00:03):
Good morning, good afternoon, or good evening,
whenever you may be, and welcometo another episode of the SOC
Brief.
This is your go-to podcast forstaying ahead of the
ever-evolving world of soccersecurity threats.
I'm your host Andrew, and todaywe're going to discuss a new
phishing as a service platformthat the FBI has publicly warned

(00:25):
about, and that is Cali365.
So this service is specificallydesigned to steal Microsoft 365
credentials and is beingactively marketed to other
criminals.
We'll discuss what Cali365 is,how it works, why it poses a
serious risk to organizations,and some practical steps your

(00:46):
SOC can take to detect anddefend against these attacks
before they lead to accounttakeovers or larger incidents.
So Cali365 is a relatively newphishing kit that has gained
traction in a lot of undergroundforums.
It provides attackers with aready-made phishing page that
closely mimics legitimateMicrosoft 365 login portals.

(01:10):
The service allows evenlow-skilled criminals to launch
convincing credential harvestingcampaigns against any M365 user.
The FBI issued a formal warningin early of April this year,
highlighting that the platformis being used to target
organizations across multiplesectors.

(01:30):
So how does this attack actuallywork?
Attackers are sending phishingemails or messages that direct
victims to a fake login page.
Once the victim enters theircredentials, Cali365 captures
them in real time.
In some configurations thatthey've seen, it can also
attempt to bypass certainmulti-factor authentication

(01:53):
methods by relaying the sessionor using adversary in the middle
techniques.
After successful theft, thestolen accounts can be used for
business email compromise, dataexfiltration, or just as a
foothold for ransomwaredeployment.
And this method is easilyaccessible and has been pretty

(02:13):
effective for them so far.
Microsoft 365 is the backbone ofproductivity for millions of
organizations, so successfulcompromise can give attackers
access to email, files, teamchats, and even administrative
controls.
The service lowers the technicalbarrier, meaning that more

(02:34):
criminals can run thesecampaigns at scale.
For SOCS specifically, thistranslates into more phishing
alerts, higher risk ofcredential-based attacks, and
the potential for rapid lateralmovement once an account is
taken over.
For detecting this attack, weshould be tuning email security
gateway and EDR to look forsuspicious login patterns from

(02:56):
unfamiliar locations or devices,especially those involving
Microsoft 365 services.
And that is an instance where aSIM really comes in handy.
Also, we need to be monitoringfor spikes in failed or
successful logins from new IPaddresses, unusual OAuth consent

(03:17):
requests, or anomalous activityin Microsoft Enter-ID logs.
You can look for known IOCs thatthe FBI and some security
researchers have shared.
And those include specificphishing domains and URL
patterns associated with theCallic 365.
From there, make sure you'reblocking and quarantining

(03:37):
high-risk email attachments andlinks at your gateway.
Make sure you're enforcingconditional access policies in
Microsoft 365 and require MFAand trusted locations.
Use application allow listingwhere possible to limit what can
run on endpoints.
For proactive hunting, gothrough your Microsoft 365 audit

(04:00):
logs and enter ID sign-inreports for anomalous activity.
You can integrate threatintelligence feeds for Cali 365
IOCs, and that way you can getearly warnings about any new
campaigns that are popping up.
Run regular credential stuffingtests against your own
environment just to see if anyleaked accounts are being

(04:20):
reused.
The bottom line here is thatthis Cali 365 activity shows
that attackers are makingcredential theft easier and more
scalable than ever.
Socks that monitor M365 closelyand force strong conditional
access and hunt for phishingindicators can really stop these
attacks before they canescalate.

(04:42):
Here's some closing thoughts anda call to action.
The FBI's warning about Cali 365is a signal that phishing as a
service tools are becoming moresophisticated and accessible.
SOCs have to stay vigilant withmonitoring, enforced layer
defenses in Microsoft 365, andkeep your teams informed.

(05:03):
These steps can helpsignificantly reduce the risk of
credential theft and follow-onattacks.
So this week, review yourMicrosoft 365 conditional access
policies and run one quick huntfor anonymous sign-ins in your
environment.
And that's a wrap for thisepisode of the Stock Brief.
Have questions or your own Cali365 stories?

(05:24):
Hit us up on social media or viaour website.
Keep your eyes open, keepsharpening those skills, and
we'll talk soon.
As always, stay secure outthere.
Bye.