As corporate networks force the adoption of multi-factor authentication, cybercriminals are finding new ways around the barrier. The FBI issued an urgent warning regarding an emerging phishing toolkit called Kali365 that allows attackers to hijack Microsoft 365, Outlook, Teams, and OneDrive accounts without stealing passwords.
Attackers send AI-generated emails pretending to be trusted cloud services. They trick users into entering a short code on a genuine Microsoft authentication page. This action unknowingly authorizes the attacker’s device using Microsoft’s own device code flow, granting the hackers persistent entry into the corporate environment.
The Phishing-as-a-Service platform first appeared in April 2026. Developers are currently selling Kali365 on Telegram for $250 per month or $2,000 for an annual subscription. The package provides low-skill threat actors with automated campaign templates and real-time tracking dashboards to launch attacks.
The threat mechanics detailed in an official FBI alert released on May 21 show exactly how the platform steals OAuth and refresh tokens. By abusing the device code sign-in flow on genuine Microsoft pages, the attackers trick the system into trusting their device instead, bypassing multi-factor authentication entirely.
Why Multi-Factor Authentication Adoption Accelerated the Kali365 Threat
Cybersecurity researchers from firms like Arctic Wolf Labs and Proofpoint watched device-code phishing activity climb sharply starting earlier this year. Attackers are abandoning traditional credential theft because basic passwords no longer grant access to modern corporate environments.
The FBI and CISA are pushing IT departments to change their default setups. They want organizations to configure Conditional Access policies in Microsoft Entra ID to block or strictly limit device code authentication flows, and to disable authentication transfer policies across devices.