Threat Intelligence / Actor / Kali365 PhaaS operators (cluster overlap with Storm-1755; opportunistic abuse by APT29 / Midnight Blizzard)

Kali365 PhaaS operators (cluster overlap with Storm-1755; opportunistic abuse by APT29 / Midnight Blizzard)

Nation: Unknown (criminal PhaaS; Russian-aligned APT29 observed as customer) · 1 tracked threat(s) · Categories: PHISHING

Also known as: Kali365, Kali 365, K365, Storm-1755, Midnight Blizzard (opportunistic abuse), APT29 (opportunistic abuse)

Tracked threats

Kali365 PhaaS — Telegram-Distributed Microsoft 365 Device-Code Phishing with OAuth Token Theft & MFA Bypass (FBI PSA I-052126-PSA) — HIGH

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence