A fast-spreading cyberattack kit called "Kali365" allows low-skill scammers to hijack a user's account without ever stealing their password.