Kal Online has been active since 2009, and as the game's player base has matured, so have the scams targeting accounts of all levels. Phishing remains the most common method: players receive messages claiming to be from Game Masters, announcing item giveaways or account verification requirements. The linked page always leads to a fake login page that captures the username and password, after which the account is used to distribute further phishing messages to the victim's friends.
The Kali365 Phishing-as-a-Service kit, identified by the FBI in May 2026, has been particularly effective against MMO players. The kit generates convincing fake login pages for multiple games, and Kal Online accounts are explicitly listed as a target in the FBI PSA. The kit's operators sell access to the phishing infrastructure for a weekly fee, and the fake pages are hosted on domains that change frequently to avoid detection. Players who reuse passwords across platforms are especially vulnerable, as a single compromised credential can unlock accounts on several services.
Item trading scams represent another frequent attack vector. A common pattern involves a "buyer" who offers to purchase an item via in-game mail, then claims they sent the payment early and asks the seller to return the item via a trade window. The trade window can be manipulated with rapid clicks, and the victim ends up sending the item without receiving payment. Another variant involves a "free rename" or "free pet skill reset" offer that requires the victim to enter their character name into a third-party website, which then uses the information to access the account.
The white online and grey offline indicators next to player names in Kal Online are frequently spoofed. Scammers create macros or bots that keep their characters online while they conduct phishing or trading scams, making the victim believe they are interacting with a legitimate player. The /deletefriend command removes the relationship, but by then the account credentials or items have already been transferred.
Protective habits that reduce risk include: never entering login credentials on a page arrived at via a link, verifying the sender identity of any Game Master message, using the /registerfriend command only with players you have personally verified, and enabling the game's two-factor authentication if available. The game's official support page warns that support staff will never ask for a password via chat, email, or third-party site, and any request for a password should be treated as a scam attempt.
Primary sources:
- FBI PSA on Kali365 Phishing-as-a-Service: https://www.ic3.gov/PSA/2026/PSA260521
- Kal Online official security page (search "kal online security" on gameforge.com)
- Community scam reports on kal.how forum