Kali365 Phishing Kit Hijacks Microsoft OAuth Tokens to Silently Bypass MFA
The FBI has flagged a device-code phishing campaign powered by Kali365, a toolkit that steals OAuth tokens tied to Microsoft 365 accounts without ever touching a user's password.
Key points
- Kali365 abuses Microsoft's OAuth 2.0 device authorization grant flow to steal access tokens and bypass MFA without intercepting credentials.
- Victims are tricked into entering an attacker-controlled code on a legitimate Microsoft endpoint, handing over a persistent authenticated session.
- Refresh tokens obtained this way can stay valid for up to 90 days, with no further MFA challenge required.
- The FBI recommends blocking device-code flow in Conditional Access and preventing session transfer from corporate PCs to mobile devices.
- No CVE has been assigned; this is a design-level misuse of a standards-compliant protocol, not a software flaw.
The FBI issued a public warning this week about Kali365, a phishing-as-a-service toolkit that abuses Microsoft's OAuth 2.0 device authorization grant flow (defined in RFC 8628) to harvest access tokens and sidestep MFA entirely. No credential interception is involved. An attacker walks away with a live, authenticated session bound to the victim's Microsoft 365 tenant.
How the attack works
The device-code flow was built for input-constrained devices, think smart TVs and printers, that can't open a browser. Kali365 weaponises it differently. An attacker initiates the flow, obtains a user_code, then drops it into a lure email impersonating a cloud document-sharing service. The victim visits microsoft.com/devicelogin, a genuine Microsoft endpoint, and enters the code. Because the domain is real, most browser-based security checks don't blink.
Entering that code authorises the attacker's registered application to receive both the access token and the refresh token. Refresh tokens for Microsoft 365 sessions can be valid for up to 90 days, and MFA won't be re-verified because authentication already completed on the victim's side. At the protocol layer, the session is indistinguishable from a legitimate device sign-in. No malware, no credential theft, no intercepted MFA push.
Should you worry?
Yes, and defenders have the clearest options inside Microsoft Entra ID, formerly Azure Active Directory. The FBI advisory recommends two primary controls: create a Conditional Access policy that blocks device-code flow for all users, with narrow exceptions for service principals that genuinely need it; and enforce an authentication transfer block so an active session can't move from a corporate Windows machine to a mobile device, a secondary vector Kali365 reportedly supports.
Neither is a one-click fix. Blanket device-code blocking can break printer-and-scanner workflows, so test in a staging tenant before pushing to production. Identifying every legitimate exemption is the harder operational problem.
We first covered Kali365 on 26 May 2026 in "FBI flags Kali365, the latest phishing kit pitched at draining Microsoft 365 tenants"; this FBI warning suggests adoption of the available mitigations hasn't moved fast enough.
Other OAuth-targeting toolkits use overlapping techniques, abusing flows that were never designed to carry attacker-controlled codes. Microsoft's own Conditional Access guidance on restricting the device-code flow has been available since 2023. The FBI advisory doesn't attribute Kali365 to a specific actor, and no CVE has been issued; this isn't a software vulnerability in the classical sense. The underlying protocol, ratified in RFC 8628, has no mechanism to verify that whoever requested the device code is who should receive the token. That gap predates Kali365 and will outlast it.
