Loading threat actor…
Kali365, also referred to as K365 and in some reporting associated with Octopi365 and Freedom365 branding, is a phishing-as-a-service platform focused on identity compromise and account takeover. First observed in 2026, it became notable for operationalizing Microsoft OAuth device-code phishing against Microsoft 365 and Entra ID users. In this workflow, operators or affiliates initiate a legitimate device authorization request and trick victims into entering the attacker-provided code on a genuine Microsoft login page. Because the victim completes normal authentication and any required MFA, the attacker receives valid OAuth tokens tied to the authorized session rather than needing to steal the password directly. This enables persistent access to cloud resources such as Outlook, OneDrive, SharePoint, and Teams until tokens are revoked or expire, and can survive password resets if token/session revocation is not also performed.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
21 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.