Search — “Kali365”

Push Security reports that fake event registration pages impersonating OpenAI, SpaceX and Anthropic lure employees to sign in with work accounts, then offer Microsoft device-code phishing via the Kali365 platform and Google AiTM reverse-proxy phishing via VoidProxy. Push Security says it detected and blocked visits to these pages in late October 2026, and the sources do not confirm any successful account compromises. Hunters should look for Microsoft device-code authentication requests and sign-ins from unfamiliar devices, plus redirects through Google or Zapier URL shorteners to event registration pages.

Huntress analyzed three phishing kits (EvilTokens, Knight Office, Kali365) targeting Microsoft 365 tokens through device-code phishing, adversary-in-the-middle relays, and token theft/replay, bypassing passwords and MFA. EvilTokens abused the Railway PaaS for token harvesting and replay. Attackers frequently register rogue devices for persistence. Hunt for device-code authentications, sign-ins from unfamiliar cloud infrastructure, automated token refresh, new device/auth method registrations, and mailbox forwarding rules.