Kali365 shows how AiTM phishing outpaces MFA controls

At a glance

What this is: This is an analysis of Kali365, a commoditised phishing infrastructure that captures Microsoft 365 sessions after MFA and then turns those sessions into follow-on business email compromise capability.

Why it matters: It matters because identity teams need to treat successful MFA as an input, not a finish line, and build controls around session behaviour, token use, and mailbox actions.

By the numbers:

• Kali365 was offered at $250/month, paid in Bitcoin, as a subscription phishing service.
• The infrastructure used port 8443 for operator panel access alongside port 443 for the victim-facing phishing portal.

Context

Phishing-as-a-Service is a subscription model for credential theft, where an operator buys the kit, the hosting, and the workflow rather than building the attack stack from scratch. In this case, the important governance problem is not just phishing volume, but the ease with which a low-skill operator can buy a session-stealing capability aimed at Microsoft 365 and turn one successful login into many downstream abuses.

AiTM session theft is the practical centre of gravity here because the kit does not need to defeat MFA in the usual sense. It waits for the victim to complete authentication, captures the post-authentication token, and then reuses the session as if it were legitimate. That shifts the control problem from login verification to session integrity and ongoing mailbox behaviour.

Key questions

Q: What happens when session cookies are stolen during MFA phishing?

A: When session cookies are stolen, the attacker may be able to reuse the authenticated session and access the victim’s account without triggering another MFA challenge. That can let the attacker move from initial access to long-term compromise, read sensitive data, and attempt lateral movement or privilege escalation across connected cloud services.

Q: Why do fresh phishing domains evade traditional detection so easily?

A: Because reputation systems depend on prior observation, while disposable infrastructure is designed to move faster than blocklists and vendor feeds. A newly registered domain can be fully operational before it accumulates enough signals to be flagged, which means detection has to rely on behaviour, not just domain reputation.

Q: What are the signs that a mailbox has been abused after login?

A: Watch for forwarding-rule creation, unusual inbox access from a new device or location, bulk contact export, and outbound messages that match the user’s tone but occur immediately after authentication. Those signals point to post-login abuse rather than a simple failed login event or a generic phishing attempt.

Q: How should teams respond when a stolen Microsoft 365 token is suspected?

A: Revoke the session, inspect mailbox rules and recent sends, reset the account, and check whether the same infrastructure touched other users. Then review whether the account was allowed to operate from unmanaged devices, because token replay is far easier when session controls are weak.

Technical breakdown

How reverse-proxy phishing captures a valid session

Kali365 uses an adversary-in-the-middle pattern, where the attacker sits between the user and the real Microsoft 365 login page. The victim sees a convincing clone of the portal, enters credentials and MFA codes, and the kit relays everything to the real service in real time. Because the user completes a genuine authentication flow, the attacker receives a valid session token instead of a password-only credential. That token can then be replayed in a separate browser without re-triggering MFA. The important technical point is that the compromise happens after authentication succeeds, not before it. The identity system sees a normal login, while the attacker inherits the authenticated state. Read Top 10 Phishing Techniques.

Practical implication: Treat MFA as necessary but insufficient, and move detection to session creation and token use.

Why fresh infrastructure defeats blocklist-led defence

The infrastructure behind this kit was deliberately short-lived, cloud-fronted, and operationally segmented. Fresh domains, Cloudflare Workers, privacy-protected registration, and rapid SSL issuance reduce the time window in which reputation systems can catch up. Blocklists are retrospective: they flag what has already been observed. That is useful for containment, but weak against infrastructure designed to be disposable. From a defender's perspective, the harder problem is not whether the domain is known, but whether the activity after authentication looks normal. When the infrastructure is built to disappear quickly, detection has to focus on behaviour rather than reputation.

Practical implication: Correlate identity events and mailbox actions so you can detect compromise before reputation feeds update.

How compromised sessions become business email compromise

Once the attacker holds a valid Microsoft 365 session, the kit can enumerate contacts, scan the mailbox for high-value threads, and send messages from the victim's account. That creates a trust multiplier: recipients see a real sender, a real email history, and a trusted tenant context. The kit can also harvest contacts for follow-on campaigns, turning one mailbox into a launchpad for broader BEC. The technical failure here is not only credential theft. It is the conversion of authenticated access into trusted communication, which is why mailbox actions, forwarding rules, and privilege discovery matter as much as the initial login. Session abuse becomes a distribution mechanism for further fraud. See the Email Identity and BEC Guide.

Practical implication: Monitor for post-login mailbox changes and outbound behaviour that would be unusual for the account.

Threat narrative

Attacker objective: The attacker wants a legitimate Microsoft 365 session that can be used to impersonate the victim, harvest contacts, and support downstream business email compromise.

1. Entry occurs through a reverse-proxy phishing page that captures credentials and MFA codes while the victim completes a real Microsoft 365 login.
2. Credential access follows when the kit steals the authenticated session token and reuses it in the attacker's browser without prompting for a new factor.
3. Escalation continues as the attacker scans the mailbox, harvests contacts, and can search for privileged accounts or high-value correspondence.
4. Impact occurs when the stolen session is used to send trusted email, enable follow-on business email compromise, or trigger account abuse inside the tenant.

Breaches seen in the wild

• Microsoft verified publisher OAuth phishing 2022: Malicious OAuth apps with a fraudulently obtained Microsoft verified publisher badge tricked UK users into granting mailbox access in 2022.
• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Session theft has become the real control boundary: This kit shows that successful MFA no longer proves trust in the session that follows. The control failure is not a weak password or a missing second factor, but the assumption that a verified login means the account is safe for the rest of the session. Practitioners should treat token replay, post-authentication mailbox abuse, and forwarding-rule creation as the real risk surface.

Reputation-based detection is structurally late: A three-day-old domain with zero detections on VirusTotal illustrates how quickly modern phishing infrastructure outpaces blocklists. By the time reputation systems learn the pattern, the kit may already have delivered its payload and been abandoned. The field needs to stop treating known-bad infrastructure as the primary detection anchor and instead prioritise behavioural evidence inside the authenticated session.

AiTM phishing is a mailbox governance problem as much as a login problem: The kit does not simply steal credentials, it turns a valid inbox into a fraud distribution channel. That means identity teams and email teams have to work from the same event stream, because contact harvesting, suspicious forwarding, and outbound impersonation all matter after the token is issued. Email identity and BEC governance becomes the right lens when one session can create many false senders.

Trustworthy sender identity can be manufactured instantly: The panel, referral model, and self-service onboarding show how phishing has become a subscription business with operational polish. That matters because the adversary no longer needs to be technically exceptional to run a high-confidence credential theft operation. The practitioner implication is that identity governance must assume industrialised abuse rather than isolated attacker craftsmanship.

Detection must move from authentication events to session behaviour: The enduring lesson is that login success is no longer a meaningful end state for assurance. Security programmes that stop at sign-in telemetry miss the actions that actually produce compromise, from inbox access to contact export and impersonation. The implication is a shift from perimeter-style authentication thinking to continuous, identity-aware monitoring of what the session does next.

What this signals

Identity monitoring has to move inside the session: The practical shift is from asking whether a login was successful to asking what the account did next. Organisations that still anchor detection on sign-in alerts will miss token replay, inbox harvesting, and impersonation because those actions happen after the identity provider has already issued trust.

Session governance is now a core BEC control: When a phishing kit can capture a valid token, the strongest control becomes the ability to constrain where that token works and how long it remains useful. That makes device posture, conditional access, and behavioural telemetry part of the same operating model rather than separate security teams' concerns.

Email impersonation and identity compromise are converging: The same attack path that steals a Microsoft 365 session can also produce the trusted sender identity needed for fraud. Programmes that separate email security from identity governance will keep missing the point where the compromise becomes operationally visible.

For practitioners

• Instrument post-authentication detections Alert on forwarding-rule creation, mass contact export, inbox access from new locations, and privilege discovery immediately after successful sign-in.
• Constrain token usability Restrict session token use to compliant, managed devices so a stolen token is less useful outside the expected device and network context.
• Shorten session lifetime and revoke aggressively Reduce the window in which a captured token remains valid, especially for accounts with access to finance, executives, or administrators.
• Correlate across investigations Use cross-case analysis to spot repeated infrastructure, shared IPs, and recurring lure patterns that single tickets will not reveal.
• Harden email identity controls Enforce SPF, DKIM, and DMARC, then pair them with mailbox takeover monitoring and payment verification for high-risk correspondence.

Key takeaways

• Kali365 shows that MFA can be satisfied and still leave the attacker with a usable Microsoft 365 session.
• Fresh phishing infrastructure shortens the window for reputation-based detection and shifts the burden to behavioural monitoring.
• The most effective controls are session constraints, mailbox telemetry, and cross-case correlation rather than login-only defences.

Related NHI Mgmt Group resources: Top 10 Phishing Techniques · Email Identity and BEC Guide · Dark Web Monitoring Guide · Top 10 Online Fraud Attacks

Key terms

• Adversary-in-the-middle phishing: A phishing method that places an attacker between the user and the real identity provider so the attacker can intercept or relay the authenticated session. It often preserves the user experience, which is why it can evade awareness and some detection paths while still producing usable session tokens.
• Session Token Theft: Session token theft is the unauthorized capture of a valid login token that lets an attacker act as an authenticated user or service without knowing the password. In IAM and NHI environments, stolen bearer tokens, cookies, or API session artifacts can bypass MFA, persist until expiry, and enable lateral access, data exposure, or privilege abuse.
• Post-Authentication Monitoring: Post-authentication monitoring is the practice of watching identity behaviour after a login, token exchange, or session start. It matters because successful authentication does not prove trustworthiness for the rest of the session, especially when attackers use valid credentials or trusted flows.
• Phishing-as-a-service: A criminal service model that packages phishing infrastructure, templates, delivery tools, and sometimes evasion features for reuse by multiple attackers. It lowers the skill threshold for advanced campaigns and makes targeted identity abuse more repeatable across victims and sectors.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.