Outsider provided phishing kits and infrastructure for cybercriminals to scam victims with lures claiming they missed packages, had unpaid tolls or parking violations.

Kali365, which was first observed in April, abuses legitimate Microsoft device authorization pages to grant persistent access to cybercriminal-controlled applications.

Cybercrime groups, including one that identifies as ShinyHunters, are targeting single sign-on services to gain access to victim networks and steal data.

SecAlliance and Silent Push confirmed that the suspected Chinese operators of the phishing kit appear to have been affected.

The suspected Chinese schemers behind it enable those constant fake E-Z Pass and U.S. Postal Service smishing messages.

The China-linked operation has grown from a phishing kit marketplace into an active and growing community supporting a decentralized large-scale phishing ecosystem.

The company acted on a court order and collaborated with Cloudflare to seize RaccoonO365’s infrastructure, which was used to steal credentials from organizations in 94 countries.

Also known as “Saim Raza,” the group was allegedly responsible for over $3 million in losses.