Kali365 Phishing-as-a-Service Threat Targets Microsoft 365 Accounts

In a public service announcement dated May 21, 2026, the FBI warned that a new phishing-as-a-service (PhaaS) platform called Kali365 is being sold primarily on Telegram. First detected in April 2026, the kit enables attackers to obtain Microsoft 365 OAuth access and refresh tokens, allowing them to bypass multi-factor authentication (MFA) without ever intercepting user passwords. By exploiting Microsoft’s device-code authentication flow, the service lets low-skill actors launch automated campaigns that impersonate trusted cloud-productivity and document-sharing services.

Kali365 Phishing Kit Hijacks Microsoft 365 AccessForbesTechRadarFBI Warns 'Kali365' Phishing Kit Hijacks Microsoft 365 OAuth TokensHow-To Geek

Microsoft’s device-code workflow was designed for devices with limited input (e.g., smart TVs). When a user enters a code on a legitimate Microsoft verification page, the platform issues an OAuth token that grants ongoing access to Outlook, Teams, OneDrive, and other services. Security researchers note that token theft is increasingly attractive because tokens maintain authenticated sessions across services and remain valid until revoked, making them more valuable than static passwords.

TechRadar

1. Phishing Email – The attacker sends an email that mimics a trusted Microsoft-linked service, using one of eight fixed templates (e.g., “SharePoint – Document Shared” or “Teams – New Message”).

Forbes

2. Device-Code Prompt – The email contains a device code and instructions to visit a genuine Microsoft verification page.

Forbes

3. User Authorization – The victim enters the code, unintentionally authorizing the attacker’s device.

Forbes

4. Token Capture – The attacker captures the OAuth access and refresh tokens, securing persistent access to the victim’s Microsoft 365 environment.

Kali365 Phishing Kit Hijacks Microsoft 365 Access

5. Post-Compromise Activity – With tokens, the adversary can read Outlook mail, join Teams chats, retrieve OneDrive files, and even register new devices, all without triggering additional MFA challenges.

TechRadar

The FBI’s advisory lists several defensive measures:

Kali365 Phishing Kit Hijacks Microsoft 365 Access

• Restrict or block device-code flow for most users, applying conditional-access policies with limited exceptions for essential business processes.

TechRadar

• Block authentication-transfer policies that allow credentials to move between computers and mobile devices.

TechRadar

• Audit existing device-code usage to identify legitimate dependencies before enforcement.

Kali365 Phishing Kit Hijacks Microsoft 365 Access

• Exclude emergency-access accounts from restrictions to avoid lockouts.

Kali365 Phishing Kit Hijacks Microsoft 365 Access

Microsoft’s own PSA echoes these steps and advises organizations to monitor authentication activity and follow the Cybersecurity and Infrastructure Security Agency’s phishing-mitigation guidance. Arctic Wolf researchers highlight the kit’s ease of use—AI-generated lures, automated dashboards, and a subscription price ranging from $10 to $1,000—underscoring the low barrier to entry for threat actors.

Forbes

Security analysts caution that the proliferation of token-theft kits like Kali365, EvilTokens, and Tycoon2FA expands the attack surface for cloud productivity platforms. The reliance on legitimate Microsoft pages makes detection difficult, and the rapid emergence of new device-code phishing tools each week suggests a growing ecosystem that could outpace current defensive controls.

Kali365 Phishing Kit Hijacks Microsoft 365 Access

• “Kali365 lowers the barrier of entry,” the bureau says, “providing less-technical attackers access to AI-generated phishing lures, automated campaign templates, real-time targeted individual/entity tracking dashboards, and OAuth token capture capabilities.” — FBI, Public Service Announcement

Forbes

• “Through the Kali365 platform subscription, cyber threat actors can capture "OAuth" tokens and gain persistent access to targeted individuals/entities' Microsoft 365 environments,” the FBI warned.” — FBI, PSA

TechRadar

• “The FBI says a new scam based on the Kali365 phishing-as-a-service platform can bypass multi-factor authentication (MFA) by tricking users into approving legitimate Microsoft logins.” — FBI, public statement

How-To Geek

• “The FBI warned that Kali365 significantly lowers the barrier to entry for cybercrime operations by offering built-in phishing templates, AI-generated phishing lures, automated campaign tools, and real-time dashboards that track victims and stolen tokens.” — FBI, advisory

Kali365 Phishing Kit Hijacks Microsoft 365 Access

• “FBI Urges Victims to Report Incidents The FBI is urging anyone impacted by the Kali365 phishing campaign to report incidents through the Internet Crime Complaint Center (IC3).” — FBI, advisory

Kali365 Phishing Kit Hijacks Microsoft 365 Access

The FBI urges victims to submit evidence to the IC3 and recommends that organizations implement the outlined conditional-access policies promptly. Ongoing monitoring by Microsoft, CISA, and security firms will track the evolution of token-theft kits, while law-enforcement investigations aim to disrupt the Telegram distribution channels that fuel Kali365’s growth.

FBI Warns 'Kali365' Phishing Kit Hijacks Microsoft 365 OAuth Tokens