Loading ATT&CK
Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice
Kali365 is a Phishing-as-a-Service (PHaaS) kit first observed in April 2026 that generates victim-targeted lures across multiple operating systems to induce users into copying and pasting actor-controlled commands for local execution.(Citation: Artic Wolf Labs Kali365 Device Code April 2026) (Citation: FBI IC3 Alert I-052126 Kali365 May 2026) (Citation: Huntress Kali365 Device Code June 2026) (Citation: SpyCloud Kali365 June 2026) Kali365 incorporates on-demand device code generation and mirrors the copy-paste execution tradecraft associated with ClickFix. (Citation: Huntress Kali365 Device Code June 2026) Operators have used Kali365 to harvest victims' OAuth tokens and session cookies through adversary-in-the-middle (AiTM) interception, enabling account takeover.(Citation: Artic Wolf Labs Kali365 Device Code April 2026) (Citation: Artic Wolf Kali365 Device Code OAuth June 2026) (Citation: FBI IC3 Alert I-052126 Kali365 May 2026) (Citation: Huntress Kali365 Device Code June 2026) (Citation: SpyCloud Kali365 June 2026) Kali365 PHaaS was first observed in April 2026.(Citation: Artic Wolf Labs Kali365 Device Code April 2026) Kali365 has also been affiliated with other branding to include Octopi365 and Freedom365.(Citation: Huntress Kali365 Device Code June 2026)
Only techniques sit in a kill chain phase.
| Direction | Type | Related object |
|---|---|---|