Summary (tl;dr)

The FBI has issued an urgent alert regarding a new "phishing-as-a-service" platform called Kali365, which is actively targeting Microsoft 365 users, including Outlook, Teams, and OneDrive, by circumventing multi-factor authentication.

Essential Background

Phishing is a type of cyberattack where criminals attempt to trick individuals into revealing sensitive information, often by disguised as a trustworthy entity in electronic communication. Multi-factor authentication (MFA) is a security measure that requires users to provide two or more verification factors to gain access to an account, typically involving something you know (password) and something you have (e.g., a code sent to your phone), to add an extra layer of security. Traditionally, phishing attacks focused on stealing passwords.

The Full Story

The Federal Bureau of Investigation (FBI) recently issued a public service announcement warning about Kali365, a sophisticated new phishing-as-a-service platform that emerged in April 2026 and is being distributed via Telegram. This platform allows even less-technical cybercriminals to launch advanced phishing campaigns targeting Microsoft 365 accounts. The scam works by sending victims a deceptive email, seemingly from a trusted cloud or document-sharing service, containing a device code and instructions to enter it on a legitimate Microsoft verification page. Once the code is entered, the attacker captures OAuth access tokens, effectively bypassing traditional passwords and multi-factor authentication, granting them persistent access to the victim's Outlook, Teams, and OneDrive accounts. This gives the attackers unauthorized access to emails, files, and other sensitive data.

Why It Matters

This trend is significant because Kali365 makes sophisticated cyberattacks accessible to a broader range of criminals, lowering the technical barrier to entry for phishing campaigns. The ability to bypass multi-factor authentication, a common security safeguard, is particularly alarming as it undermines a key defense mechanism many users rely on. Victims risk data theft, fraud, extortion, and ransomware attacks once their Microsoft 365 accounts are compromised. The FBI recommends that organizations implement Conditional Access policies to restrict or eliminate device code authentication and advises individuals to be vigilant against unsolicited emails asking for device codes. Microsoft is also actively working to disrupt these cybercriminal ecosystems.

Geographic Location

• Washington, D.C., District of Columbia, United States (FBI issued public service announcement)
• Los Angeles, Los Angeles County, California, United States (a related story was reported from this location)
• North America (organizations targeted by Kali365 attacks)
• Europe (organizations targeted by Kali365 attacks)