FBI warns of Kali365 phishing-as-a-service targeting Microsoft 365 accounts

A subscription-based phishing kit called Kali365 can bypass two-factor authentication entirely. Here's how it works and how to protect yourself. The FBI has issued an urgent public warning about a rapidly spreading cyberattack tool that can break into Microsoft 365 accounts, including Outlook, Teams and OneDrive, without ever needing the account holder's password or triggering a two-factor authentication alert.The FBI's Internet Crime Complaint Center (IC3) issued Public Service Announcement I-052126-PSA on May 21, warning about a Phishing-as-a-Service platform called Kali365, first seen in April 2026. The tool is sold through Telegram as a criminal subscription product for as little as $250 for 30 days.The targets span a broad range of sectors. The campaign has hit manufacturing, education, insurance, financial, healthcare and government organisations.What makes Kali365 differentMost phishing attacks work by tricking people into handing over their usernames and passwords on a fake login page. Kali365 does not work that way, and that is what makes it dangerous.Kali365 enables cyber threat actors to obtain Microsoft 365 access tokens and bypass multi-factor authentication protocols without intercepting the user's credentials.Instead, it exploits a legitimate Microsoft authentication feature called the OAuth device code flow, where attackers trick users into logging into their accounts through a legitimate authentication flow and then steal their access and refresh tokens.The platform lowers the barrier of entry, providing less-technical attackers access to AI-generated phishing lures, automated campaign templates, real-time targeted individual/entity tracking dashboards, and OAuth token capture capabilities.How the attack works: step-by-stepThe FBI has laid out exactly how Kali365 operates, in four stages:Step 1: An attacker sends a phishing email impersonating trusted cloud productivity and document-sharing services. The email contains a device code with instructions to visit a legitimate Microsoft verification page and enter the code.Step 2: The targeted individual navigates to the real Microsoft page and pastes in the device code, unknowingly authorizing the attacker's device to access their account.Step 3: The attacker captures OAuth access and refresh tokens, granting them access to the targeted individual's Microsoft 365 account.Step 4: The attacker can now access Microsoft 365 services such as Outlook, Teams and OneDrive without needing a password or completing any additional MFA challenges.In short: the victim logs in normally on a real Microsoft page and unknowingly hands the keys to an attacker.What to watch out for- Unexpected emails appearing to come from Microsoft or cloud document-sharing services asking you to visit a verification page and enter a code- Emails urging urgency around account verification or document access- Login alerts or active sessions you do not recognise in your Microsoft account- Unfamiliar devices appearing in your account's registered device list- Inbox rules you did not create, particularly those forwarding or deleting messages automaticallyHow to protect yourself: FBI's official tipsThe FBI's IC3 advisory recommends the following steps, sourced directly from PSA I-052126-PSA:- Block device code flow: Create a conditional access policy to block device authentication codes for all users, with limited exceptions only for essential business processes.- Audit first: Before applying a blanket block, audit existing device code flow usage to identify any legitimate dependencies to avoid disrupting business operations.- Block authentication transfer: Apply policies to prevent users from transferring authentication sessions from computers to mobile devices.- Protect emergency accounts: If device code flow cannot be fully restricted, exclude emergency access accounts from the policy to prevent lockouts.The FBI also directs users to the Cybersecurity and Infrastructure Security Agency's (CISA) Phishing Guidance document for additional best practices.If you have been affectedIf the Kali365 phishing kit has impacted you or someone you know, file a complaint with the Internet Crime Complaint Center at ic3.gov. Include any available information such as phishing emails (header and body), suspicious logins (time, IP address, location), and any unauthorised devices or active sessions added to the account.

The FBI has issued a warning about Kali365, a new Phishing-as-a-Service platform enabling attackers to steal Microsoft 365 OAuth tokens and bypass MFA. This platform lowers the barrier for cybercriminals, providing AI-generated lures and automated campaign tools. Users are advised to restrict device code flow and implement conditional access policies to protect their accounts.

FBI warns Microsoft users of Kali365 scam duping thousands: How the scam works and how users can protect  The Times of IndiaFBI issues urgent Kali365 security warning for Teams, Outlook, OneDrive users  The HillEvilTokens: A phishing attack that doesn’t steal your password  WeLiveSecurityFBI warns Microsoft Teams, Outlook, OneDrive users of phishing scam  Fast CompanyNew Browser-in-the-Browser phishing uses fake login popups to steal Microsoft 365 credentials  Help Net Security

alternative_right shares a report from The Hill: The FBI released an urgent security warning to the public about a fast-acting scam targeting Microsoft 365 users on Teams, Outlook and OneDrive. The agency warned that the hacking platform Kali365 seeks out OAuth device codes, allowing scammers to sneak past multi-factor authentication codes, and without the need for a password, to access Microsoft accounts. Scammers will send a phishing email impersonating a trusted document-sharing service with a device code and instructions on how to verify, according to the FBI. "Kali365 lowers the barrier of entry, providing less-technical attackers access to AI-generated phishing lures, automated campaign templates, real-time targeted individual/entity tracking dashboards, and OAuth token capture capabilities," the FBI stated. The platform is sold to scammers with a $250 per month subscription. The FBI, which first detected Kali365 in April, described the hacking platform as an "emerging Phishing-as-a-Service platform." Hackers with limited skills can access advanced phishing tools through the platform, according to NordPass. Read more of this story at Slashdot.

The FBI released an urgent security warning to the public about a fast-acting scam targeting Microsoft 365 users on Teams, Outlook and OneDrive. The agency warned that the hacking platform Kali365 seeks out OAuth device codes, allowing scammers to sneak past multi-factor authentication codes, and without the need for a password, to access Microsoft accounts....

The security measure millions rely on to protect their accounts may not be as foolproof as they think.The Federal Bureau of Investigation is warning the public about a fast-spreading scam targeting users of popular Microsoft 365 products, including Outlook, Teams, and OneDrive. The scheme allows cybercriminals to capture Microsoft authentication tokens, bypassing multifactor authentication without needing a user’s password. At the center of the scheme is a hacking platform called Kali365. Unlike traditional phishing attacks that rely on stealing credentials, Kali365 targets OAuth device codes—digital keys that allow applications to access data without requiring a password—giving cybercriminals access to Microsoft 365 accounts and a wide range of sensitive information. The subscription-based service, which was first spotted in April 2026, has been promoted largely through Telegram and, according to Bitdefender, is available to scammers for as little as $250 per month or $2,000 a year. What makes the threat particularly alarming is that it can gain access to a user’s account without a password. “Kali365 lowers the barrier of entry, providing less-technical attackers access to AI-generated phishing lures, automated campaign templates, real-time targeted individual/entity tracking dashboards, and OAuth token capture capabilities,” the FBI said. With security researchers reporting hundreds of Kali365 attacks in April alone, the threat is already materializing.  How the scheme unfolds The attack follows a deceptively simple sequence. A victim receives a phishing email designed to look like it came from a trusted cloud service. The email contains a device code and instructs the recipient to visit a legitimate Microsoft verification page to enter it.  The moment the user does this, the user has unknowingly handed the attacker full access to their account. Once the code is entered, the attacker captures the OAuth access token, granting them full entry into the victim’s Microsoft 365 account. From there, they can freely navigate Outlook, Teams, and OneDrive without ever needing a password or completing any additional authentication steps. What makes the scam particularly convincing is that there is no fake website to spot and no misspelled domain name, making it difficult for a user to distinguish the phishing attempt from a legitimate request. “This phishing scam is getting more sophisticated by the day, with AI-generated lures and automated templates,” one user wrote in response to the FBI’s warning. However, the FBI says there are steps users can take to protect themselves, including not opening any links with access codes that you didn’t request. Additionally, those who have been affected by the Kali365 phishing kit can file a complaint with the Internet Crime Complaint Center. —Amaya Nichole, News Writer This article originally appeared on Fast Company’s sister website, Inc.com.  Inc. is the voice of the American entrepreneur. We inspire, inform, and document the most fascinating people in business: the risk-takers, the innovators, and the ultra-driven go-getters that represent the most dynamic force in the American economy.