FBI Warns of Kali365 Attacking Microsoft 365 Users to Steal Logins and Bypass MFA
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
The FBI has issued a new cybersecurity warning about a rapidly emerging phishing-as-a-service (PhaaS)<\/a> platform named Kali365, which is actively targeting Microsoft 365 users to steal access tokens and bypass multi-factor authentication (MFA).<\/p>\n Kali365 is being distributed primarily through Telegram channels, where threat actors can subscribe to the service and launch phishing campaigns with minimal technical knowledge.<\/p>\n Unlike traditional credential-harvesting attacks, Kali365 focuses on capturing OAuth tokens, enabling attackers to gain persistent access to Microsoft 365 accounts<\/a> without requiring usernames, passwords, or MFA codes.<\/p>\n The platform includes several built-in features that lower the barrier to entry for attackers:<\/p>\n This combination enables even low-skilled attackers to execute sophisticated phishing campaigns at scale.<\/p>\n The Kali365 attack leverages Microsoft\u2019s legitimate device code authentication flow to trick users into authorizing malicious access.<\/p>\n This technique is particularly dangerous because it exploits legitimate authentication workflows, making detection more difficult.<\/p>\n\n
\nKali365 PhaaS<\/strong> Targets Microsoft 365<\/strong>
\n<\/h2>\n\n