FBI Warns 'Kali365' Phishing Kit Hijacks Microsoft 365 OAuth Tokens
A Telegram-distributed phishing-as-a-service platform is letting low-skill attackers bypass MFA entirely — no password required.
Written by OutOfToken AI
June 4, 2026 · 4 min read · Synthesized from reporting by Infosecurity Magazine · How this works
The FBI has issued a formal Public Service Announcement warning organizations about Kali365, a phishing-as-a-service platform first observed in April 2026 that weaponizes Microsoft 365's own authentication infrastructure against its users. Unlike conventional credential-harvesting attacks, Kali365 doesn't bother stealing passwords — it steals OAuth access tokens, rendering multifactor authentication effectively useless. The platform's wide availability on Telegram means the barrier to executing sophisticated account takeovers has collapsed to near zero.
Device Code Flow, Turned Into a Weapon
At the core of Kali365's attack chain is an abuse of Microsoft's device code flow — a legitimate OAuth 2.0 mechanism originally designed to let input-constrained devices, such as smart TVs or printers, authenticate to cloud services by delegating the login process to a secondary device. In normal use, a device generates a short code, the user enters it on a trusted machine, and an access token is issued back to the originating device. Kali365 inverts this entirely: attackers generate a device authorization request, embed the resulting code in a convincing phishing lure, and trick the target into approving it. Once the victim authenticates — using their own credentials and MFA — the token is handed directly to the attacker, not the legitimate device.
Telegram as a Distribution Channel
The FBI's advisory underscores a growing trend in the cybercriminal ecosystem: Telegram has become a fully functioning marketplace for offensive tooling. Kali365 is distributed, updated, and supported through the platform's private channels and bot infrastructure, allowing operators to spin up phishing campaigns with minimal technical overhead. The PhaaS model means buyers don't need to understand OAuth internals or build proxy infrastructure — Kali365 abstracts all of it. Subscription tiers, customer support, and even pre-built phishing templates are reportedly part of the package, mirroring the professionalization that transformed ransomware into an industry over the past half-decade.
""Kali365 lowers the barrier of entry for cybercriminals" — FBI Public Service Announcement, 2026. Attackers need no stolen password and no MFA bypass exploit. A single user click is sufficient to hand over full account access."
Why Traditional Defenses Fall Short
The implications for enterprise security teams are uncomfortable. Conditional access policies that gate entry on device compliance or known IP ranges may offer some protection, but organizations that have treated MFA as their primary security layer are acutely exposed. Because the victim themselves completes the authentication flow — entering the correct password and approving the MFA prompt — identity providers see a clean, legitimate login event. Detection depends on behavioral anomalies: unusual OAuth application consent grants, access from unexpected geolocations post-token-issuance, or flagged device code flow requests from unmanaged endpoints. Microsoft has mechanisms to restrict device code flow on a per-tenant basis through Conditional Access policies, and the FBI's advisory implicitly pushes organizations toward tightening those controls. Enterprises that haven't audited which applications are permitted to use device code flow in their tenants are flying blind.
Kali365 is a signal, not an anomaly. As identity becomes the dominant security perimeter, attackers are engineering around it with increasing precision — not by breaking cryptography or exploiting zero-days, but by subverting the legitimate workflows enterprises rely on. The FBI's advisory will prompt a round of security bulletins and policy reviews, but the deeper challenge is structural: cloud authentication protocols optimized for usability consistently create attack surface when users can be manipulated into approving requests they don't fully understand. Until organizations treat OAuth token hygiene with the same rigor as password management, PhaaS platforms like Kali365 will keep finding willing buyers and willing victims.
Editorial Note
Infosecurity Magazine is a reputable cybersecurity news outlet with established credibility for reporting on threats. FBI warnings about phishing kits and OAuth token theft are consistent with documented attack patterns targeting Microsoft 365 users. The specific mechanics described (phishing-as-a-service, OAuth token hijacking) align with known threat actor tactics, though the claim would benefit from direct FBI advisory documentation or public statement verification.
Claim Tracker
AI-assessed
Future date (April 2026) is anachronistic and suggests possible error in article or test content. Cannot verify observation date.
Technical claim attributed to FBI but no independent technical analysis provided. Specifics of attack mechanism not independently verified.
No specific channel, handle, or evidence provided. Distribution method claimed but not substantiated.
Device code flow is a legitimate OAuth 2.0 mechanism. The specific attack vector description aligns with known OAuth security vulnerabilities, though application to this specific kit remains unverified.
Technically accurate: OAuth token theft bypasses MFA because authentication occurs at token generation, not token usage.
Ask AI about this story
// discussion
sign in to join the discussion