<\/p>\n
The Federal Bureau of Investigation (FBI) has issued a public warning about a newly identified cybercrime platform called Kali365, a \u201cPhishing-as-a-Service\u201d (PhaaS) toolkit that is being used to target Microsoft 365<\/a> users by bypassing multi-factor authentication (MFA) protections.<\/p>\n<\/div>\n The platform, first detected in April 2026, is being actively distributed through Telegram channels and is designed to help even low-skilled attackers conduct sophisticated phishing campaigns.<\/p>\n<\/div>\n Kali365 is a cybercrime subscription service that allows threat actors to carry out automated phishing attacks against cloud-based accounts, particularly Microsoft 365 environments.<\/p>\n<\/div>\n According to the FBI<\/a>, the platform provides attackers with ready-made tools including:<\/p>\n<\/div>\n -AI-generated phishing emails and templates<\/p>\n<\/div>\n -Automated campaign management systems<\/p>\n<\/div>\n -Real-time victim tracking dashboards<\/p>\n<\/div>\n -OAuth token capture capabilities<\/p>\n<\/div>\n This effectively lowers the technical barrier for cybercriminals, enabling more widespread and scalable attacks.<\/p>\n<\/div>\n The FBI outlined a multi-stage process used by attackers leveraging Kali365:<\/p>\n<\/div>\n Victims receive emails impersonating trusted cloud services or document-sharing platforms. These emails contain a device code and instructions to visit a legitimate Microsoft login page.<\/p>\n<\/div>\n 2. User authentication trick<\/p>\n<\/div>\n The victim enters the device code on the official Microsoft page, unknowingly authorizing the attacker\u2019s device.<\/p>\n<\/div>\n The system captures OAuth access and refresh tokens, giving attackers authenticated access to the victim\u2019s account.<\/p>\n<\/div>\n Attackers can then access services such as Outlook, Teams, and OneDrive without needing passwords or triggering MFA again.<\/p>\n<\/div>\n The FBI warned that this allows attackers to maintain long-term access to compromised accounts.<\/p>\n<\/div>\nWhat is Kali365?<\/h2>\n
How the attack works<\/h2>\n
Why this attack is dangerous<\/h2>\n