FBI Warns Kali365 PhaaS Platform Targets Microsoft 365 Users to Steal Logins

The U.S. Federal Bureau of Investigation (FBI) has issued a Public Service Announcement (Alert I-052126-PSA) warning about a newly identified Phishing-as-a-Service (PhaaS) platform named Kali365, which is actively targeting Microsoft 365 users.

First observed in April 2026, the platform enables attackers to bypass multi-factor authentication (MFA) by exploiting OAuth-based authentication flows.

Kali365 PhaaS Platform Targets Microsoft 365

Kali365 is distributed primarily through Telegram channels and offers a subscription-based model, making advanced phishing attacks accessible to less technically skilled threat actors. The platform provides:

• AI-generated phishing email templates
• Automated campaign deployment tools
• Real-time victim tracking dashboards
• OAuth token harvesting capabilities

This combination allows attackers to scale phishing campaigns efficiently while maintaining persistence in compromised environments.

Unlike traditional credential theft, Kali365 leverages Microsoft’s legitimate device code authentication flow to trick users into granting account access.

• Phishing Lure: Victims receive emails impersonating trusted services such as Microsoft or document-sharing platforms. These emails include a device code and instructions to authenticate.
• User Authorization: The victim visits an official Microsoft login page and enters the provided device code, believing it is legitimate.
• Token Capture: Once authenticated, attackers capture OAuth access and refresh tokens tied to the victim’s account.
• Persistent Access: With these tokens, attackers gain ongoing access to services like Outlook, Teams, and OneDrive without needing passwords or triggering MFA challenges.

This technique is particularly dangerous because it abuses legitimate authentication workflows, making detection more difficult.

The use of OAuth tokens allows attackers to maintain long-term access even if a user changes their password. Organizations risk data exfiltration, business email compromise (BEC), and lateral movement within cloud environments.

The FBI notes that this method represents a growing trend in phishing attacks that focus on session hijacking rather than credential theft.

Mitigation and Protection Measures

The FBI and CISA recommend several defensive actions to mitigate Kali365-related threats:

• Restrict or turn off device code authentication flows where possible
• Implement conditional access policies to block unauthorized device code usage
• Audit existing device authentication workflows for legitimate use cases
• Block authentication transfer between devices
• Maintain emergency access accounts to avoid administrative lockouts

User awareness also remains critical, especially regarding unsolicited authentication requests.

Organizations and individuals impacted by Kali365 campaigns are advised to report incidents to the Internet Crime Complaint Center (IC3). Key information to include:

• Phishing email content and headers
• Suspicious login activity (IP, time, location)
• Unauthorized sessions or devices linked to accounts

CISA’s phishing mitigation guidance further emphasizes early detection and proactive defense strategies to disrupt attack chains at initial stages.

Kali365 highlights the evolving sophistication of phishing ecosystems, where attackers increasingly exploit trusted authentication mechanisms rather than relying solely on stolen credentials.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.