FBI Warns of Kali365 Phishing-as-a-Service Targeting Microsoft 365

The Federal Bureau of Investigation (FBI) issued a Public Service Announcement (PSA), warning the public about an emerging Phishing1-as-a-Service2 (PhaaS) platform called Kali365.

First seen in April 2026, Kali365 has primarily been distributed via Telegram, enabling cyber threat actors to obtain Microsoft 365 access tokens and bypass multi-factor authentication (MFA) protocols without intercepting the user's credentials.

As stated in the FBI warning, cyber threat actors can capture "OAuth" tokens through the Kali365 platform subscription and gain persistent access to targeted individuals/entities' Microsoft 365 environments.

“Kali365 lowers the barrier of entry, providing less-technical attackers access to AI-generated phishing lures, automated campaign templates, real-time targeted individual/entity tracking dashboards, and OAuth token capture capabilities,” it said.

How the Kali365 scam works

As explained by FBI, cyber attackers deploy following tactics to lure citizens through the Kali365 subscription:

Lure: An attacker sends a phishing email impersonating trusted cloud productivity and document-sharing services. This phishing email contains a device code with instructions to visit a legitimate Microsoft verification page and enter the code.

Authorization: The targeted individuals/entities navigate to the real Microsoft page and pastes in the device code, unknowingly authorizing the attacker's device to access their account.

Token Theft: The attacker captures OAuth access and refresh tokens, granting them access to the targeted individuals/entities' Microsoft 365 account.

Persistence: The attacker can now access Microsoft 365 services such as Outlook, Teams, and OneDrive without needing a password or completing any additional MFA challenges.

Tips to protect yourself

FBI has also shared a list of security tips that one can take to avoid falling for the Kali365 scam. These are:

Restricting device code flow to limit or block device authentication codes can help prevent or limit this style of attack.

Create a conditional access policy to block device code flow for all users, with limited exceptions for required business processes.

Audit existing device code flow usage to identify legitimate dependencies before creating a conditional access policy.

Block authentication transfer policies to prevent users from transferring authentication from computers to mobile devices.

If you cannot completely restrict device code flow usage, exclude emergency access accounts to prevent lockouts.

“If you or someone you know has been impacted by the Kali365 Phishing kit, file a complaint with the Internet Crime Complaint Center (IC3) at www.ic3.gov. Be sure to include any available information, such as:

Any phishing emails (email header, body)

Suspicious logins (time, IP address, location)

Any unauthorized devices or active sessions added to the account,” the FBI said.