A sophisticated cyberattack campaign has been uncovered, targeting US companies with a novel exploit that leverages Microsoft’s authentication mechanisms against its own security protocols. Dubbed “Kali365,” this attack vector takes advantage of vulnerabilities in Microsoft Azure Active Directory (Azure AD), allowing attackers to gain elevated privileges and traverse organizational boundaries.
At the core of Kali365 is an innovative use of cross-domain privilege escalation, which enables threat actors to bypass traditional security controls and pivot between different parts of a company’s infrastructure. By exploiting weaknesses in Azure AD’s authentication process, attackers can assume the identity of authorized users and move freely throughout the network, effectively “weaponizing” Microsoft’s own security mechanisms against it.
This attack campaign has left several prominent US companies reeling, with reports suggesting that sensitive data has been compromised and business operations disrupted. The affected organizations are from various industries, including finance, healthcare, and technology. As this story continues to unfold, one thing is clear: the threat landscape has evolved, and traditional security measures may no longer be sufficient.
The technical underpinnings of Kali365 involve a combination of social engineering tactics and sophisticated exploitation techniques. Attackers use phishing emails or other forms of deception to trick employees into revealing their Azure AD credentials, which are then used to gain unauthorized access to the network. Once inside, threat actors leverage cross-domain privilege escalation to move laterally and assume higher levels of privileges, often using legitimate administrative tools against themselves.
The Kali365 attack campaign has significant implications for enterprise security teams, as it highlights the need for more robust authentication and authorization controls. Companies must revisit their security posture and consider implementing additional measures such as multi-factor authentication, real-time monitoring, and advanced threat detection capabilities. This will require a collaborative effort between IT teams, compliance officers, and executive management to ensure that sensitive data is properly protected.
As the cybersecurity landscape continues to shift, organizations must remain vigilant and adapt to emerging threats. The Kali365 attack campaign serves as a stark reminder of the importance of staying ahead of the curve in terms of security measures and best practices. In light of this development, we recommend that companies prioritize the following: conduct regular vulnerability assessments, implement robust access controls, and engage in ongoing employee education to prevent social engineering attacks from taking root.
Source: The Hacker News — 2026-08-05