Kali365 Phishing Kit Hijacks Microsoft OAuth Tokens to Silently Bypass MFA

The FBI issued a public warning this week about Kali365, a phishing-as-a-service toolkit that abuses Microsoft's OAuth 2.0 device authorization grant flow (defined in RFC 8628) to harvest access tokens and sidestep MFA entirely. No credential interception is involved. The attacker walks away with a live, authenticated session bound to the victim's Microsoft 365 tenant.

How the bug works

The device-code flow was designed for input-constrained devices — think smart TVs and printers — that cannot open a browser. An attacker initiates that flow themselves, obtains a user_code, then embeds it inside a lure email that impersonates a cloud document-sharing service. The victim is instructed to visit microsoft.com/devicelogin (a legitimate Microsoft endpoint) and enter that code. Because the domain is genuine, the visit clears most browser-based security checks without complaint.

Entering the code authorizes the attacker's registered application to receive the access token and, critically, the refresh token. Refresh tokens for Microsoft 365 sessions can be valid for up to 90 days. The attacker now holds a persistent credential that MFA will never be asked to re-verify, because authentication already completed on the victim's side during the code-entry step. The session is indistinguishable, at the protocol layer, from a legitimate device sign-in.

So the attack requires zero malware on the endpoint, zero credential theft, and zero interception of an MFA push. It is a straight abuse of a standards-compliant flow.

Microsoft's identity platform surfaces this under the Entra ID (formerly Azure Active Directory) conditional access engine, which is also where defenders have the most leverage. The FBI's advisory recommends two primary controls. First, create a Conditional Access policy that blocks the device-code flow for all users, carving out only the specific service principals that genuinely require it for business operations. Second, enforce an authentication transfer block so that an active session cannot be handed from a corporate Windows machine to a mobile device — a secondary abuse vector Kali365 reportedly supports.

And neither control is a one-click fix. Blanket device-code blocking can break legitimate printer-and-scanner workflows (a point worth stress-testing in a staging tenant before pushing to production). Identifying every exemption is the harder operational problem.

Kali365 joins a growing catalogue of OAuth-targeting toolkits; Evilginx2 and the now-notorious Storm-2372 campaign (attributed by Microsoft Threat Intelligence to a Russian-aligned actor in early 2025) use overlapping techniques. The pattern is consistent: abuse flows that were never designed to carry attacker-controlled codes.

The FBI advisory does not assign Kali365 to a specific threat actor or nation-state cluster, and no CVE has been assigned — this is not a software vulnerability in the classical sense, but a design-level misuse of the OAuth device authorization grant. Microsoft's own guidance on restricting the device code flow in Conditional Access has existed since 2023; the FBI warning signals that adoption of those controls remains far from universal.

The underlying protocol design, ratified in RFC 8628, has no mechanism to verify that the entity requesting the device code is the same entity that should receive the token. That gap predates Kali365 and will outlast it.