Executive Summary
The FBI has issued a warning regarding a Phishing-as-a-Service (PhaaS) platform named Kali365, which has been active since April 2026. This platform enables low-skilled adversaries to conduct sophisticated Microsoft 365 account compromises by abusing the legitimate device code authentication flow. Unlike traditional phishing that intercepts credentials, Kali365 leverages Microsoft's own infrastructure to authorize attacker sessions, effectively rendering standard MFA protections ineffective.
Technically, the attack involves sending AI-generated phishing lures that direct victims to legitimate Microsoft verification URLs. Victims are prompted to enter an attacker-generated code; once entered, the attacker receives a persistent OAuth token. This token allows for long-term access to Outlook, Teams, and OneDrive without triggering further MFA alerts or password change requirements.
This threat is particularly significant because it circumvents link-reputation engines and domain blocklists by utilizing authentic Microsoft domains. Organizations are urged to review their Entra ID policies and restrict device code flow to mitigate the risk of unauthorized persistent access.