A newly discovered phishing‑as‑a‑service platform is letting cybercriminals hijack Microsoft 365 accounts, including Outlook, Teams, and OneDrive, without ever stealing a password, prompting a serious public warning from the FBI to businesses and individuals. The tool, known as Kali365, abuses a legitimate Microsoft login feature to bypass multi‑factor authentication (MFA) and steal login tokens that give attackers ongoing access to corporate email and files.
What the FBI is warning about
In a public service announcement issued on May 21 and expanded in follow‑up media briefings, the FBI says cybercriminals are using Kali365, a subscription phishing‑as‑a‑service platform, to steal access tokens and take over Microsoft 365 accounts. The platform first appeared in April and is being promoted in criminal channels on Telegram, targeting organizations and individuals that rely on Outlook email, Teams collaboration and OneDrive storage.
Unlike classic credential‑stealing scams, Kali365 “allows threat actors to obtain Microsoft 365 access tokens and bypass multi‑factor authentication without needing to intercept user credentials,” the FBI warns. Once attackers have those tokens, they can repeatedly access a victim’s 365 environment “without requiring a password or completing any further MFA challenges.”
Cyber‑security outlets describe Kali365 as a turnkey kit that gives even low‑skilled attackers AI‑generated phishing lures, automated campaign templates, real‑time victim dashboards and token‑capture tools, all for as little as roughly $250 per month.
How the Kali365 scam works
At the core of the threat is attackers’ abuse of Microsoft’s OAuth 2.0 device code flow, a legitimate feature designed to let users sign in on devices like smart TVs or command‑line tools without typing passwords.
The FBI and security analysts outline the attack chain as follows:
1. Phishing email that looks legitimate
The victim receives an email impersonating a trusted cloud or document‑sharing, for example, a notice about a shared file or secure document. The message includes a short device code and instructions to visit a real Microsoft verification page.
2. Redirection to a genuine Microsoft site
Following the instructions, the user goes to Microsoft’s legitimate device login page (on a microsoft.com domain) and pastes in the code, believing they are authorizing access to a document or app.
3. Silent token theft
Behind the scenes, that code is tied to the attacker’s application. When the victim approves it, Microsoft issues OAuth access and refresh tokens, “proof” that the user has logged in, which Kali365 captures and passes to the attacker.
4. Ongoing access to Microsoft 365
Using those tokens on their own machines, attackers can access the victim’s Microsoft 365 account, Outlook, Teams, OneDrive, and other services, and refresh their access without needing the password or triggering additional MFA prompts.
Fox‑owned LiveNOW and other broadcasters emphasize that because the user visits a genuine Microsoft page and may already expect MFA prompts, the scam can be harder to spot than traditional fake‑login pages.
Why this is different from “ordinary” phishing
Traditional phishing typically tricks users into entering usernames and passwords into counterfeit websites; MFA adds a second hurdle by requiring a code or prompt from a separate device.
Kali365 changes the equation in several ways:
- It never asks the user for their password, instead piggybacking on a legitimate device‑code flow.
- It circumvents MFA by design, because once a trusted device or app is approved, Microsoft’s systems treat the OAuth tokens as proof of authentication.
- It lowers the barrier to entry by packaging advanced techniques in a subscription service, complete with AI‑authored lures and ready‑made templates that non‑technical criminals can use.
Forbes’ security analysis notes that “Kali365 diminishes the entry barriers,” making it easier for relatively unsophisticated attackers to mount campaigns that previously required custom coding. Cybersecurity Dive and BleepingComputer both highlight that this approach turns Microsoft’s own authentication framework into an unwitting attack surface, rather than a line of defense.
Who is at risk
The advisory is directed primarily at organizations using Microsoft 365, but the FBI stresses that individual users — especially small‑business owners and professionals — are also at risk.
Kali365 gives attackers persistent access to:
- Outlook – reading and sending email, including initiating invoice fraud or internal phishing.
- Teams – monitoring internal chats, meetings and files shared in channels.
- OneDrive and SharePoint – exfiltrating documents, intellectual property and stored backups.
Law‑enforcement and security blogs point out that once inside a tenant, attackers can move laterally, impersonate executives, reset passwords and plant forwarding rules to quietly harvest email over long periods.
The FBI’s technical guidance to Microsoft 365 admins
In its alert and subsequent media interviews, the FBI lays out specific steps for IT and security teams to blunt Kali365‑style attacks.
Key recommendations include:
Limit or block device‑code authentication
The bureau urges organizations to use Conditional Access policies in Microsoft Entra ID (formerly Azure AD) to “prevent all users from using device code flow, with minimal exceptions.” Admins should audit which apps and service accounts genuinely need device‑code logins and block the rest by default.
Block authentication transfer between devices
The FBI advises disabling policies that allow authentication sessions to move from computers to mobile devices, which attackers can exploit to transfer token‑based access.
Preserve emergency access, but lock it down
Where device‑code flow cannot be fully disabled, emergency or “break glass” admin accounts should be exempted to avoid lockouts but protected with phishing‑resistant MFA, such as hardware security keys.
Monitor and audit OAuth activity
Security teams are encouraged to review sign‑ins involving device codes, unusual app consents and new device registrations, and to revoke suspicious sessions promptly.
Microsoft told outlets that it agrees with the FBI’s guidance and pointed administrators to its own best‑practice resources on device‑code flows, Conditional Access, and token security.
Advice for everyday Microsoft 365 users
While most mitigations are implemented at the tenant level, the FBI and Microsoft stress that individual behavior still matters.
Users are urged to:
Treat unsolicited device codes as red flags
If you receive an email with a device code and instructions to visit a Microsoft site, especially if you weren’t expecting any new login, do not follow the instructions.
Verify senders and links
Check the sender’s address carefully, hover over links to inspect URLs and, when in doubt, access documents via your usual OneDrive or SharePoint menus rather than email links.
Be wary of unexpected “secure documents”
Many Kali365 lures pose as urgent invoices, legal documents or HR files shared via cloud services. If you weren’t expecting such a file, confirm with the sender through another channel.
Keep systems patched and MFA enabled
Even though Kali365 can bypass some MFA flows, Microsoft and the FBI still recommend keeping MFA on and ensuring operating systems and apps are fully updated, to reduce exposure to other attack types.
Consumer‑facing posts from news outlets and police departments on Facebook and X bluntly summarize the risk: “A new phishing tool can bypass Microsoft 365 multi‑factor authentication, giving hackers access to your Outlook, Teams and OneDrive.”
Reporting incidents
The FBI is asking victims and targeted organizations to report suspected Kali365 activity to its Internet Crime Complaint Center at IC3.gov, including examples of phishing emails, suspicious sign‑in logs and unknown devices or sessions attached to accounts. These reports, agents say, help them map out how widely the platform is being used and which criminal networks are behind it.
Security experts interviewed in coverage of the alert say the broader lesson goes beyond one toolkit. As more attacks abuse “legit” cloud features and rely on AI‑authored lures, organizations will need to harden identity systems, not only endpoints, and users will need to recognize that even a genuine Microsoft login page can be dangerous if it’s reached by following the wrong prompt.
