Huntress traced unusual device code authentication activity from Tencent Cloud to a suspected Kali365 campaign and identified a much larger footprint behind it, including more than 240 IPs hosting multiple panel variants. The kit is far more than a phishing page. Huntress found a full Phishing-as-a-Service (PhaaS) ecosystem with at least 33 built-in lure templates, 100+ API endpoints, RBAC, billing, a domain marketplace, and multiple editions tailored for different operator goals.