Kali365 — Microsoft 365 OAuth Device Code PhaaS
FBI PSA · Dual Domain Seizure · 90 Tencent Cloud IPs · Telegram Bot Leak

Kali365 operates as a tiered subscription PhaaS platform distributed via Telegram since February 2026, first catalogued by Palo Alto Unit42 on 2026-04-24. At $250/month paid in Bitcoin or USDT (via OxaPay gateway), the platform attracted approximately 300 affiliates by end of March 2026 and 500+ by May 2026 before the FBI PSA triggered a theatrical shutdown. Revenue is estimated at $200K–$350K across the full February–June 2026 operation window.

The platform ships in three editions. E1 provides the base AiTM and device code kit with 33 lure templates targeting Microsoft 365 services (Teams, Outlook, SharePoint, OneDrive), DocuSign, Dropbox, Google Drive, and Adobe. E2 adds a post-compromise AI-BEC module with Exchange admin abuse, keyword monitoring for payment/invoice-related emails, and a contact harvester that extracts victim organization communications for downstream fraud. E3 is a reseller edition with self-service provisioning, enabling a multi-tier affiliate model where sub-affiliates purchase access via shared referral links.

The desktop component, branded "OctoLink Live" (also seen as "kali365-live" and later "Green Octopus 3.1.0"), is an Electron application that loads captured OAuth tokens and provides authenticated one-click access to victim Outlook, OneDrive, and SharePoint portals without requiring any password or MFA interaction. A companion tool, "OctoLink Sender," uses the Microsoft Graph API to send lateral phishing from compromised mailboxes at 2,500 emails per token per day, with burst limiting (80 sends with 120-second cooldowns) and human-like jitter (5–12 second pauses every 12–19 sends) to evade mail flow anomaly detection.

"Ghost mode" automatically removes MFA notifications, password change alerts, and sign-in warning emails from victim inboxes, suppressing victim awareness of the compromise. The full device code authorization flow from lure delivery to token capture completes in approximately 42 seconds.

WHOIS inspection reveals that both primary Kali365 infrastructure domains have been placed on hold by NameSilo, LLC. The original platform domain kali365.xyz carries serverHold status, indicating a registry-level seizure — typically issued under law enforcement coordination or ICANN abuse action. The panel domain securehubcloud.com, the migration infrastructure registered on May 16, 2026 (three days before the FBI PSA), carries clientHold status, indicating a registrar-initiated hold by NameSilo following the FBI publication.

The branding timeline shows rapid iteration: kali365.xyz → octopi365.com → blackoctopusking.live (announced May 7, 2026) → securehubcloud.com (registered May 16, 2026). The operators notified customers on May 21, 2026 — the same day the FBI PSA published — that they were "officially closing the website and discontinuing operations." Intelligence from SpyCloud and Huntress confirms activity continued post-announcement under the "Green Octopus" brand.

SSL certificate transparency for securehubcloud.com shows 7 confirmed subdomains provisioned via Let's Encrypt (E8/E7 chains) and Sectigo within a 3-day window. The origin.securehubcloud.com subdomain resolved directly to the BL Networks panel IP 66.179.30.87 before Cloudflare proxying was applied, exposing the backend hosting provider. The privacy-protected WHOIS registrant (PrivacyGuardian.org, Phoenix AZ) is consistent with all previous Kali365 domain registrations.

Huntress published 90 confirmed Tencent Cloud IPs used by Kali365 affiliates to conduct device code authentication attempts against victim Microsoft 365 accounts. All 90 IPs fall within AS132203 (TENCENT-NET-AP-CN, Tencent Building, Kejizhongyi Avenue, Shenzhen, CN), predominantly in the CIDR range 43.173.64.0/18 with additional clusters in 43.130.x.x, 43.131.x.x, 43.135.x.x, 43.153.x.x, 43.157.x.x, 43.159.x.x, 43.165.x.x, 43.166.x.x, 49.51.x.x, 162.62.x.x, and 170.106.x.x. These IPs appear in Microsoft Unified Audit Log (UAL) entries as the sources of successful device code authentication grants.

The operator control panel ran on 66.179.30.87 (BL Networks LLC, Sheridan, Wyoming, abuse: admin@blnwx.com) before Cloudflare proxying. This IP is now dead. A secondary BL Networks IP, 199.91.220.111 (CIDR 199.91.220.0/23, NetName BNL-77), returns nginx/1.24.0 Ubuntu on all paths with HTTP 404 — server alive, panel content stripped. This is consistent with panel migration or takedown response.

The 126-host cluster documented by Arctic Wolf (active May 6–27, 2026) was deployed as a single backend rotated across disposable front-end domains, enabling rapid campaign regeneration after domain seizures. Cloudflare Workers and Pages.dev instances handled lure routing, with discovered worker patterns matching [a-z]{5}-[a-z]{4}-[a-z0-9]{4} naming conventions across multiple Cloudflare accounts.

Arctic Wolf researchers, during active investigation of the Kali365 operator expansion into MAX Messenger (Russian state-backed messaging platform), documented the Telegram exfiltration bot credential in full. The bot @NovosibyrskyMoneyBot (internal name: sova_novosibirsk_bot) receives stolen phone numbers, one-time passwords, and 2FA passwords captured from victims across all supported phishing templates.

The bot name is a direct Russian language reference: "Novosibirsk" is the third-largest city in Russia (Siberia), and "Novosibirsky Money" maps to a known Russian-language underground financial fraud context. The "sova" prefix (Russian for "owl") is a recurring theme in Russian-speaking cybercrime infrastructure. This operator naming convention strongly suggests a Russian-speaking threat actor group operating out of or affiliated with Siberia-based criminal networks.

The leaked token format 8535071077:AAFus1ccm-puZ2htZkpKP_UyZfp3FTHFCzg follows the standard Telegram Bot API format (bot_id:secret). The numeric prefix 8535071077 is the bot user ID. The chat group -5035652280 (negative ID indicating a group or supergroup, not a direct chat) is the delivery channel for all exfiltrated credentials.

The MAX Messenger phishing flow the bot supports captures Russian phone numbers (+7 prefix), legitimate MAX SMS/push OTPs, and 2FA passwords in sequence — a complete account takeover chain for Russian consumers alongside the primary M365 targeting.

Arctic Wolf documented a significant expansion of the Kali365 operator's targeting scope beyond Microsoft 365, establishing this as a multi-platform identity theft operation. The operator deployed phishing pages targeting MAX Messenger (Russian state-backed messaging platform), Okta SSO, Xerox DocuShare, GMX (German email), LiveDrive (UK cloud storage), Mail.ru, Yandex Disk, Odnoklassniki, and AWS (mimicked endpoint naming). The Russian-platform targeting (MAX, Mail.ru, Yandex, Odnoklassniki) alongside Siberia-branded Telegram infrastructure corroborates the Russian-speaking operator hypothesis.

The MAX Messenger phishing domain greatness-marketing[.]top deployed a prize-claim social engineering lure. The backend attachedfile[.]com (39 subdomains observed, registered 2026-02-14 by Hostinger, last updated 2026-07-21) served as a persistent Cloudflare-proxied front for lure hosting across multiple campaigns. The domain predates Kali365's April public launch by two months, suggesting earlier-stage infrastructure preparation or a shared prior operation.

Detection fingerprints identified across all expanded deployments: HTML loader text "Preparing your secure document..." shared across all lure templates, and Cloudflare Workers with same-origin fetch pattern data-form-o5pu[.]p-ntz8agp6[.]workers[.]dev. The VALIDIN banner hash febb622cd9eeb5c8860dcef4cbfd4b74 and TLS certificate SHA1 6894a51278ec89118276c2dd2dc36e6f9ea2790a provide consistent infrastructure fingerprinting across all Kali365/Green Octopus deployments.

ANY.RUN analysis identified 34 phishing domains in the Kali365 campaign infrastructure, predominantly using .de TLD — strongly clustering on German-sounding generic names as lure delivery domains, with a secondary cluster on workers.dev Cloudflare-hosted templates.

Live verification (2026-08-19): Navigating directly to tk.mowell.tech in a browser returns {"msg":"invalid uri"} — a structured JSON error from custom application code, not a generic web server response. This is definitive proof the tracking backend is still running live business logic. The server is not a parked page or residual nginx default — it is an active API endpoint waiting for victim tracking tokens appended to specific URI paths. The operators shut down the phishing front-ends but left their data collection engine completely running. Three months after the FBI PSA "closure," the tracking infrastructure is still operational.

The Kali365 attack chain exploits the OAuth 2.0 Device Authorization Grant (RFC 8628), a flow designed for input-constrained devices like smart TVs, printers, and IoT hardware. The attacker initiates the flow against their own registered application (Microsoft client ID d3590ed6-52b3-4102-aeff-aad2292ab01c, the Office app identity), obtains a user_code valid for 15 minutes, and embeds it in a phishing lure. When the victim visits microsoft.com/devicelogin (a legitimate Microsoft URL) and enters the code, the attacker's application receives the OAuth access_token and refresh_token directly from Microsoft's authorization server.

No phishing proxy is needed. No fake login page. The victim interacts only with real Microsoft infrastructure. MFA completes legitimately. The attacker's session is authorized before the victim closes the browser. The refresh token provides access for months without re-authentication, enabling persistent Outlook, Teams, OneDrive, and SharePoint access.

The E2 post-compromise module then weaponizes the compromised mailbox: a contact harvester extracts all communications, a BEC keyword engine flags emails matching payment, invoice, wire transfer, and accounting terms, and the AI template generator crafts reply-chain phishing messages using the victim's real email history and writing style. The "Ghost mode" suppresses all Microsoft security notifications from the victim's inbox, maintaining stealth for the full access window.

The parallel AiTM path (Evilginx2 reverse-proxy "ginX" instances) captures ESTSAUTH session cookies and OAuth artifacts from interactive MFA sessions, providing an alternative capture method for targets that do not follow the device code lure.