Discover the latest findings from OBRELA's ongoing investigation into Kali365, a Phishing-as-a-Service (PhaaS) operation targeting Microsoft 365 environments.
Building on our May 2026 advisory, this follow-up reveals how Kali365's infrastructure has evolved, including newly identified panel infrastructure, the redesigned "Nova Edition" interface, and practical threat-hunting guidance.
Inside the advisory, you'll discover:
· 431 unique panel IP addresses identified across multiple scanning sources.
· How the redesigned "Nova Edition" panel compares with the previously observed infrastructure.
· New insights into panel deployments, exposed status endpoints, and token activity.
· Why rapidly rotating IP addresses limit the effectiveness of static blocklists.
· Actionable Microsoft Sentinel hunting queries and recommendations to strengthen detection and response.
Complete the form to access the full Threat Advisory and explore OBRELA's latest research findings.