FBI warns Kali365 phishing service targeting Microsoft 365

The Federal Bureau of Investigation has issued a public warning about a new and sophisticated phishing platform that is enabling cybercriminals to hijack Microsoft 365 accounts while bypassing multifactor authentication protections. The service, known as Kali365, was first observed in April and is primarily distributed through the Telegram messaging app.

According to the FBI, the platform operates as a "phishing-as-a-service" kit, lowering the technical barrier for less-skilled attackers by offering AI-generated phishing lures, automated campaign templates, real-time tracking dashboards, and tools to capture OAuth tokens. A subscription reportedly costs as little as $250 per month.

The attack exploits Microsoft's legitimate "device code" authentication flow, a feature designed to let users sign into services on devices with limited keyboards, such as smart TVs. The scam begins with a phishing email impersonating trusted cloud services like SharePoint, OneDrive, or Microsoft Teams. The email contains instructions directing the recipient to visit Microsoft's legitimate device login page and enter a provided authentication code.

When a victim enters that code on the genuine...