Kali365 and AiTM phishing: are your MFA controls enough?

TL;DR: Kali365, a $250/month Phishing-as-a-Service kit, proxies Microsoft 365 logins, steals session tokens after MFA, and uses fresh Cloudflare-fronted infrastructure to evade detection, according to Todyl research. The lesson is that authentication controls protect the door, but session governance and post-authentication monitoring decide whether an attack can keep working.

Editorial analysis by NHI Mgmt Group, based on content published by Todyl: “Kali365 PhaaS: Inside the Attack Infrastructure”.

By the numbers:

• Kali365 was offered at $250/month, paid in Bitcoin, as a subscription phishing service.
• The infrastructure used port 8443 for operator panel access alongside port 443 for the victim-facing phishing portal.

Key questions

Q: What happens when session cookies are stolen during MFA phishing?

A: When session cookies are stolen, the attacker may be able to reuse the authenticated session and access the victim’s account without triggering another MFA challenge.

Q: Why do fresh phishing domains evade traditional detection so easily?

A: Because reputation systems depend on prior observation, while disposable infrastructure is designed to move faster than blocklists and vendor feeds.

Q: What are the signs that a mailbox has been abused after login?

A: Watch for forwarding-rule creation, unusual inbox access from a new device or location, bulk contact export, and outbound messages that match the user’s tone but occur immediately after authentication.

Practitioner guidance

• Instrument post-authentication detections Alert on forwarding-rule creation, mass contact export, inbox access from new locations, and privilege discovery immediately after successful sign-in.
• Constrain token usability Restrict session token use to compliant, managed devices so a stolen token is less useful outside the expected device and network context.
• Shorten session lifetime and revoke aggressively Reduce the window in which a captured token remains valid, especially for accounts with access to finance, executives, or administrators.

Bottom line: Kali365 shows that MFA can be satisfied and still leave the attacker with a usable Microsoft 365 session.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →