The FBI has issued an urgent warning about a fast-spreading phishing scheme targeting users of Microsoft 365 products, including Outlook, Teams, and OneDrive. At the center of the threat is a hacking platform known as Kali365, which enables cybercriminals to capture Microsoft authentication tokens without needing a user's password.
Unlike traditional phishing attacks that steal login credentials, Kali365 targets OAuth device codes—digital keys that allow applications to access data without a password. This technique bypasses multifactor authentication entirely, giving attackers access to email, files, and other sensitive information across Microsoft 365 accounts.
The subscription-based service, first spotted in April 2026, is promoted primarily on Telegram. According to Bitdefender, Kali365 is available to scammers for as little as $250 per month or $2,000 per year, dramatically lowering the barrier for less-technical attackers.
What makes this threat particularly alarming is its ability to compromise accounts without the user's password. The platform is reported to incorporate AI-generated content to improve its phishing lures, making them more convincing. The FBI's warning emphasizes that the security measure millions rely on—multifactor authentication—may not be as foolproof as users think.
No specific patch or mitigation has been announced for Kali365 attacks beyond standard security hygiene. Microsoft has not yet issued an official response. Users are advised to review OAuth permissions regularly and be cautious of unsolicited device code prompts. The broader context highlights a growing trend of phishing-as-a-service platforms targeting authentication bypass mechanisms.