Kali365 Isn't Your Problem. Your Session Cookie Is.

A new phishing kit got a name this year, and the whole industry lost the plot. Kali365. The FBI put out a warning. Elli Shlomo, Head of Security Research at Guardz, published a sharp technical teardown of exactly how it works. And now every MSP in the country is emailing their vendors asking the same question: "are we protected against Kali365?"

Wrong question. Ask it and you've already lost, because you're chasing the name instead of the shift behind it.

Kali365 is not the threat. It's a receipt. Proof that a technique good operators have used quietly for years just got packaged, priced, and put on the shelf for anyone with $250 and a crypto wallet. Chase the kit and you'll spend the rest of your career playing whack-a-mole with the next one. Understand what it goes after and you actually get somewhere.

What it actually goes after

Kali365 doesn't want your password. Read that twice, because it breaks the model most people still run on. It isn't trying to trick your users into typing credentials into a fake login box. It wants what comes after the login: your OAuth tokens and your session cookies. The little artifacts that tell Microsoft "this person already proved who they are, wave them through."

It grabs them two ways. One walks the victim through a device-code approval on Microsoft's real login page, so they clear their own MFA prompt while the attacker pockets tokens good for up to 90 days. The other quietly proxies the whole session through attacker infrastructure, and the user sees genuine Microsoft domains and certificates the entire time. Either way, MFA fires exactly like it's supposed to.

And it changes nothing. Nobody was trying to beat MFA. They were after the thing MFA hands you once it's done.

Sit with that, because we sold MFA to a whole generation of clients as the finish line. Flip it on, tick the box, sleep better. Kali365 is a $250-a-month reminder that the finish line moved while we were still taking the victory lap.

This isn't new. It's just cheap now.

Here's the part that should bother you. The technique isn't clever anymore. What used to take a skilled operator running Evilginx off a VPS is now a point-and-click dashboard with AI-written lures, Telegram alerts, and an affiliate program. The attack didn't get better. The packaging did. Somebody turned a working technique into a SaaS product a low-skill criminal can run out of the box. Cheap is what changed, and cheap is what should scare you, because cheap is what turns a niche technique into everybody's problem.

The numbers back it up. Microsoft's 2025 Digital Defense Report clocked identity-based attacks up 32% in the first half of the year, and device-code phishing (one of Kali365's two main modes) grew so fast that 93% of the incidents they tracked all year landed in the back half. Ontinue's threat team put the whole era in one sentence I keep stealing: "attackers aren't breaking in anymore, they're logging in." In one case they documented crooks abusing OAuth tokens to walk into more than 700 organizations without ever breaching the platform underneath. No exploit. Just a valid session.

Identity is the perimeter. I'm done saying it gently.

"Identity is the new perimeter" has been on conference slides so long it stopped meaning anything. Kali365 is what that line looks like when someone operationalizes it and rents it by the month.

For most businesses there's no network edge left to defend. The apps are SaaS. The data lives in Microsoft 365 or Google Workspace. The people are remote or hybrid, logging in from devices and networks you'll never control. The only thing between an attacker and your business is proof of identity, and more and more that proof is a reusable token. The session cookie is the key to the building now. We spent a decade and a fortune armoring endpoints and firewalls, and we left the tokens sitting on the floor.

Let me be straight, because credibility beats hype. Token and session theft is still a sliver of the total. Microsoft's own numbers put the exotic stuff under 3%, while password spray against reused, already-breached passwords stays the bread and butter. Anyone telling you passwords are dead is selling you something. But every expensive attack in this business rides the same road: rare, then productized, then everywhere. Kali365 is the productized mile marker. You're watching it happen in real time.

And this isn't just an MSP story

Guardz aimed this at MSPs, and they were right to. An MSP is the perfect target: dozens of M365 tenants, lean team, default settings, and one compromised identity plane hands an attacker the whole client book. That multiplier is genuinely scary.

But calling it "an MSP problem" lets everyone else off the hook, and everyone else is exposed too. The fifteen-person law firm. The town running on stock Microsoft settings. The manufacturer whose entire IT department is one tired admin and a break-fix guy on speed dial. No SOC. No threat hunting. They turned on basic MFA because we told them that was the finish line, and they think they're covered. Because we told them they were.

The floor just moved up, and a huge chunk of the economy is sitting under it. The gap between "we have MFA" and "we'd notice a stolen session" is the gap that matters now, and most small and mid-size shops don't even know it's there.

What actually changes

If authentication itself is the battlefield now, a few things follow. None of them are a product you buy your way out of. They're posture.

Assume the login is already stolen. Stop pouring everything into stopping initial access and start building to catch what happens after it. Kali365's post-compromise playbook (hidden inbox rules, rogue device registration, internal phishing from a trusted account) is loud if you're watching and invisible if you're not. For identity, detection isn't the backstop behind prevention. Detection is the control.

Turn on the settings you've been calling optional. Phishing-resistant MFA (FIDO2 keys, passkeys, number matching) is the difference between MFA a proxy can replay and MFA it can't. Kill device-code flow with a conditional access policy and you delete most of one entire attack mode in a single change, and almost nobody who doesn't need it has bothered. Token protection and device-compliance rules bind a session to the hardware, so a stolen cookie is dead the second it leaves the machine it came from. You already own most of this. You just never switched it on.

Put eyes on identity. Identity threat detection and response, watching for AiTM patterns, weird Graph API activity, malicious inbox rules, sketchy OAuth consents. Build it or buy it. For most SMBs that means leaning on an MSP who actually gets this shift, which is exactly why Guardz pointed the warning at MSPs in the first place. If the providers don't level up, the businesses underneath them can't either.

Bottom line

Kali366 is coming. Different name, same DNA, probably before this time next year. "We blocked Kali365" isn't a strategy. It's a to-do item you'll rewrite every quarter until you retire.

The target moved. It's not your password and it's not really even your login anymore. It's the proof of your login, the token and the session, the thing living in the gap between "authenticated" and "still trusted an hour later." Guard that. Instrument it. Be ready to kill it fast. Do that, and the next named kit is just noise. Keep watching the front door while they stroll out the back with your session cookie, and no amount of MFA is going to save you.

Sources

*Elli Shlomo, Head of Security Research at Guardz, "The Rise of Kali365 and Why MSPs Should Be Concerned" (June 2026), the research this article responds to; Microsoft, 2025 Digital Defense Report, on identity-attack growth and device-code phishing trends; Ontinue, 2H 2025 Threat Intelligence Report, on OAuth token abuse across 700+ organizations. Figures reflect public reporting available as of mid-2026.*

We told everyone identity was the new perimeter for ten years. Kali365 is the bill coming due for how few of us built like we meant it.