FBI warns of Kali365 phishing targeting Microsoft 365

The Federal Bureau of Investigation has issued an urgent public warning about a sophisticated, automated phishing campaign targeting Microsoft 365 users worldwide. The operation, powered by a cybercrime subscription platform known as Kali365, is designed to bypass multifactor authentication and hijack access to corporate and personal accounts.

The threat exploits a method known as device code phishing. Potential victims receive emails that appear to originate from legitimate document-sharing or cloud services. These messages contain a unique device code and instructions directing the recipient to an official Microsoft login page. When the user enters the supplied code on that genuine page, they inadvertently authorize a hacker’s device to connect to their account. This process allows the attackers to intercept OAuth access tokens, granting them authenticated entry to services like Outlook, Teams, and OneDrive without ever needing the user’s password.

Security officials emphasize that this token-based hijacking poses a significant challenge. Because passwords are not stolen and standard verification checks are neutralized, intruders can maintain access even if credentials are...