FBI Warns of Kali365: A Rising Phishing Threat Exploiting Microsoft 365 Authentication

The FBI has recently issued a critical warning regarding a burgeoning cybercrime service known as Kali365. This platform represents a new wave of Phishing-as-a-Service (PhaaS) that empowers attackers to hijack Microsoft 365 accounts without the need for traditional password theft. By leveraging this service, even low-skilled cybercriminals can bypass multi-factor authentication (MFA) protections, exploiting Microsoft’s legitimate device authentication workflow.

Launched in April 2026, Kali365 is primarily disseminated through Telegram channels and has already been linked to numerous phishing campaigns targeting organizations and individuals globally. Unlike conventional methods that focus on stealing usernames and passwords, attackers using Kali365 aim to capture OAuth access tokens. These tokens grant long-term access to Microsoft 365 environments, including Outlook, Teams, and OneDrive.

How the Kali365 Phishing Kit Works

The FBI has detailed the operational mechanics of the Kali365 platform, which relies on a deceptively simple attack chain designed to exploit user trust. The attack typically initiates with a phishing email that impersonates trusted productivity or document-sharing services. This email contains a device authentication code and instructs the recipient to visit a legitimate Microsoft verification page.

Given that the webpage is genuine, many users mistakenly assume the request is safe. Once the targeted individual enters the provided code, they inadvertently authorize the attacker’s device to access their Microsoft 365 account. The attacker then captures OAuth access and refresh tokens, enabling persistent access without requiring the victim’s password or additional MFA verification.

This method is particularly perilous as it circumvents traditional credential theft. Instead, it exploits Microsoft’s authentication framework to gain legitimate session access. The FBI has noted that once the token capture is successful, attackers can continue accessing services such as Outlook, Teams, and OneDrive without triggering additional login prompts.

The Growing Threat of OAuth Token Theft

Security experts have observed a rising trend in OAuth token theft among cybercriminals, as it allows them to bypass many conventional security controls. Unlike passwords, OAuth tokens are designed to maintain authenticated sessions across multiple services. If compromised, these tokens can provide attackers with ongoing access until they are revoked or expire.

The FBI has highlighted that Kali365 significantly lowers the barrier to entry for cybercrime operations. It offers built-in phishing templates, AI-generated phishing lures, automated campaign tools, and real-time dashboards that track victims and stolen tokens. This democratization of phishing capabilities means that attackers no longer require advanced technical expertise to launch phishing campaigns against organizations utilizing Microsoft 365.

Furthermore, the platform’s availability on Telegram facilitates the distribution and monetization of phishing infrastructure at scale, making it increasingly accessible to threat actors.

Recommended Protection Measures Against Kali365 Attacks

In response to the escalating threat posed by Kali365, the FBI has advised organizations to restrict or block device code authentication flows wherever feasible. Key recommendations include implementing conditional access policies that block device code flow for most users while allowing limited exceptions for essential business operations.

Organizations are also encouraged to audit existing device authentication workflows to identify legitimate dependencies before enforcing restrictions. Additionally, the FBI recommends blocking authentication transfer policies that permit authentication to move between computers and mobile devices, as these workflows can be exploited during phishing attacks.

For organizations unable to completely disable device code flow, the agency suggests excluding emergency access accounts from restrictions to prevent accidental lockouts during critical situations.

Reporting Incidents and Mitigation Guidance

The FBI urges anyone affected by the Kali365 phishing campaign to report incidents through the Internet Crime Complaint Center (IC3). Victims are encouraged to preserve and submit phishing emails, suspicious login activity, unauthorized devices, IP addresses, and active session information that could assist investigators.

The agency has also directed users to phishing mitigation guidance published by the Cybersecurity and Infrastructure Security Agency (CISA), which outlines defensive measures organizations can adopt to reduce phishing risks.

The emergence of Kali365 Phishing-as-a-Service underscores a significant shift in cybercriminal tactics, moving towards token-based attacks that exploit trusted authentication systems rather than relying solely on password theft. As phishing platforms continue to evolve, security experts caution that organizations utilizing cloud productivity platforms like Microsoft 365 must implement stronger identity protection measures and closely monitor authentication activity to mitigate the risk of account compromise.

Source: thecyberexpress.com

Keep reading for the latest cybersecurity developments, threat intelligence and breaking updates from across the Middle East.