The FBI is warning organizations about Kali365, a phishing-as-a-service platform built to compromise Microsoft 365 accounts by abusing OAuth device code authentication.
The concern is not that Kali365 steals a password in the traditional sense. Instead, the service is designed to trick a user into authorizing an attacker-controlled session through Microsoft’s legitimate device login flow. If the user completes the process, the attacker can receive an OAuth access token and use it to access the victim’s Microsoft 365 environment without needing to defeat a separate MFA prompt.
That makes Kali365 especially relevant for companies that have treated MFA as the final line of defense against account takeover. MFA still matters, but device code phishing shows how attackers can work around it by convincing users to approve a real authentication request for the wrong device.
How Kali365 Uses Device Code Phishing
Microsoft’s device code flow exists for legitimate reasons. It lets devices with limited input options, such as smart TVs, conference room systems, printers, streaming devices, and some IoT equipment, authenticate through a second device. A user is shown a short code, opens Microsoft’s device login page on another device, enters the code, and completes sign-in.
Kali365 turns that same workflow into a phishing path. In a typical attack, the threat actor starts the device authorization process first, generating a code tied to the attacker’s session. The victim is then pushed, usually through phishing or social engineering, to enter that code into Microsoft’s real device login page.
Because the page is legitimate, the interaction can look less suspicious than a standard credential-harvesting site. If the victim signs in and completes MFA, the attacker may receive an access token for the session they initiated.
The practical result is account access without the attacker needing the user’s password or a stolen MFA code. Depending on tenant configuration and the user’s permissions, that access may expose mailbox content, Microsoft 365 data, and other applications connected through single sign-on. The extent of access will vary by environment and has not been independently verified for every affected organization.
What Makes Kali365 Different From Basic Phishing Kits
The FBI says Kali365 first appeared in April 2026 and has been distributed through Telegram channels used by cybercriminals. Its appeal is that it packages a more advanced attack method for operators who may not have the skills to build the infrastructure themselves.
Reported Kali365 capabilities include:
- Device code phishing workflows aimed at Microsoft 365 and Microsoft Entra accounts.
- AI-assisted phishing lures and campaign templates.
- Real-time dashboards for tracking victims.
- Token-capture functions designed to preserve access after authentication.
- An adversary-in-the-middle mode referred to as “Cookie Link.”
Security researchers have described Kali365 as operating with a business-like structure, including administrators, resellers, and affiliates. That matters for defenders because it means the same core platform can show up across many separate campaigns, with different lures and operators using similar underlying tradecraft.
Yubico Security Key C NFC
A FIDO2 hardware security key can help organizations move higher-risk accounts toward phishing-resistant authentication. It should be paired with Conditional Access controls and device-code-flow restrictions, not treated as a complete defense by itself.
As an Amazon Associate I earn from qualifying purchases.
What Compromised Accounts Can Be Used For
Once attackers gain access to a Microsoft 365 account, email is often the first target. Mailboxes can contain invoices, internal approvals, password reset messages, customer data, and sensitive business discussions. Attackers may also create inbox rules to hide replies, delete security warnings, or quietly forward messages.
Researchers have also observed attackers registering new devices in some compromised environments. That can help extend access and make cleanup harder, especially if administrators focus only on password resets and miss token revocation, device registrations, and suspicious OAuth activity.
For buyers and IT leaders, the takeaway is straightforward: security tools that only look for fake login pages or stolen passwords may miss this pattern. Device code phishing is an identity and session-abuse problem, so the controls need to cover authentication flows, conditional access, token activity, and mailbox behavior.
What Organizations Should Check Now
The FBI’s recommended response centers on reducing unnecessary exposure to device code authentication and tightening monitoring around identity activity.
Organizations should review the following areas:
- Restrict or block device code authentication with Conditional Access policies where business operations allow it.
- Audit legitimate use of device code authentication before applying broad blocks.
- Review authentication transfer policies that allow sessions to move between devices.
- Look for suspicious device registrations tied to user accounts.
- Check mailboxes for hidden forwarding rules, deletion rules, or unusual inbox filters.
- Review sign-in logs for device code flow events, unfamiliar locations, and abnormal client activity.
- Revoke suspicious sessions and tokens after confirmed compromise.
Blocking device code authentication outright may not be realistic in every environment. Some organizations depend on it for shared devices or specialized hardware. In those cases, the better approach is to allow it only where needed, apply stricter conditions, and monitor it as a high-risk sign-in pattern.
Synology DiskStation DS224+ NAS
A small business NAS can provide a local destination for Microsoft 365 backup workflows, including mailbox and file recovery planning. It is most useful when paired with tested restore procedures and separate identity incident-response controls.
As an Amazon Associate I earn from qualifying purchases.
Incident Response Considerations
If an organization suspects Kali365 or similar device code phishing activity, the response should go beyond changing the user’s password. A password reset alone may not invalidate every active session or remove attacker-created persistence.
A practical response should include token revocation, review of registered devices, mailbox rule inspection, Conditional Access review, and a check for unusual app consent or OAuth activity. Security teams should also preserve phishing emails, suspicious login details, and unauthorized device registration records for investigation.
The FBI has asked impacted organizations to report incidents through the Internet Crime Complaint Center. That reporting can help investigators connect campaigns that may look isolated from the victim’s side.
Why This Matters For Microsoft 365 Buyers And Admins
Kali365 is part of a broader shift in phishing. Attackers are not only trying to steal usernames and passwords; they are increasingly targeting the authentication process itself. Other phishing platforms, including EvilTokens and Tycoon2FA, have also been associated with Microsoft 365 and Entra account compromise attempts using modern session and token-focused methods.
For organizations evaluating security products or Microsoft 365 protection plans, the useful question is not just whether a tool blocks phishing emails. It is whether it can help detect suspicious authentication flows, risky OAuth behavior, malicious mailbox rules, token misuse, and unauthorized device activity.
Device code phishing succeeds when a legitimate feature is left too broadly available and users are persuaded to complete a real sign-in for an attacker. Kali365 gives that tactic a packaged service model, which means defenders should treat device code authentication as a control surface, not a background Microsoft feature that can be ignored.