MITRE ATT&CKsoftware (malware)

S9044 Kali365

Published 2026-07-30 Modified 2026-07-31 Official page ↗
Domain
enterprise
Platforms
IaaS, macOS, Windows
Version
1.0
Created
2026-07-30

Description

Kali365 is a Phishing-as-a-Service (PHaaS) kit first observed in April 2026 that generates victim-targeted lures across multiple operating systems to induce users into copying and pasting actor-controlled commands for local execution. Kali365 incorporates on-demand device code generation and mirrors the copy-paste execution tradecraft associated with ClickFix. Operators have used Kali365 to harvest victims' OAuth tokens and session cookies through adversary-in-the-middle (AiTM) interception, enabling account takeover. Kali365 PHaaS was first observed in April 2026. Kali365 has also been affiliated with other branding to include Octopi365 and Freedom365.

Related

Uses · MITRE ATT&CK (17)

  • T1683.001 Written Content sub-technique
  • T1204.004 Malicious Copy and Paste sub-technique
  • T1564.008 Email Hiding Rules sub-technique
  • T1059.007 JavaScript sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1204.001 Malicious Link sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1087.003 Email Account sub-technique
  • T1557 Adversary-in-the-Middle technique
  • T1552.001 Credentials In Files sub-technique
  • T1550.001 Application Access Token sub-technique
  • T1539 Steal Web Session Cookie technique
  • T1528 Steal Application Access Token technique
  • T1185 Browser Session Hijacking technique
  • T1090 Proxy technique
  • T1102 Web Service technique

References