Story perspectives

FBI Alerts: Kali365 Steals M365 Tokens, Bypasses MFA

5/26/2026

Summary

FBI Warns

FBI warned on May 21 that Kali365 steals Microsoft 365 OAuth tokens and bypasses MFA.
The service, first seen April 2026 and sold on Telegram, uses phishing emails that mimic services to prompt victims to paste a device code on a Microsoft page.
Captured tokens let attackers open Outlook and OneDrive without passwords.
FBI recommends restricting device-code flow and blocking authentication-transfer rules, noting subscriptions cost $10-$1,000 per month.

Summary

Kali365 Enables Phishing

Kali365 offers AI-generated phishing templates that lower attacker skill needs.
It can register unlimited devices on a hijacked Microsoft 365 account for persistent access.
Phishing emails use eight fixed subject lines, like “SharePoint – Document Shared,” and attach Office files.
Admins should block device-code flow unless essential and exempt emergency accounts to avoid lockouts.
Telegram sellers also offer EvilTokens and Tycoon2FA, revealing a wider phishing-as-a-service ecosystem.

1 of 2

FBI Warns

FBI warned on May 21 that Kali365 steals Microsoft 365 OAuth tokens and bypasses MFA.
The service, first seen April 2026 and sold on Telegram, uses phishing emails that mimic services to prompt victims to paste a device code on a Microsoft page.
Captured tokens let attackers open Outlook and OneDrive without passwords.
FBI recommends restricting device-code flow and blocking authentication-transfer rules, noting subscriptions cost $10-$1,000 per month.

1 / 2