FBI flags Kali365, the latest phishing kit pitched at draining Microsoft 365 tenants

Key points

• The FBI's Internet Crime Complaint Center has warned that Kali365, a phishing-as-a-service platform, is being used to compromise Microsoft 365 accounts at scale.
• The kit abuses OAuth device code authentication, a legitimate sign-in flow, to capture session tokens and bypass multi-factor authentication.
• Higher subscription tiers bundle anti-bot pages and geofencing to block security researchers.
• Confirmed post-access activity includes business email compromise, invoice fraud, internal phishing and mailbox exfiltration via Microsoft's Graph API.
• The FBI asks victims to report incidents to ic3.gov.

How does Kali365 actually work?

Kali365 sits in the same lineage as EvilProxy and Tycoon 2FA. The novelty lies in the social-engineering flow rather than any cryptographic trick. Victims receive a lure pointing at a real Microsoft login page; the operator, having started a device code grant on the back end, prompts the target to enter a short numeric code. Microsoft duly issues a session token to the attacker's device. MFA completes successfully because, from Entra ID's perspective, nothing looks wrong.

The technique isn't new. Volexity documented it against Russian state activity earlier this year, and Microsoft's own identity engineering guidance has suggested blocking the device code flow via Conditional Access wherever it isn't actively required. Most tenants don't need it. Most leave it on regardless.

With 14 MFA-bypass stories published in the last 90 days here at Threat Vectr, the pattern is familiar: a legitimate authentication option, enabled by default, handed to attackers on a plate.

What do attackers do once they're in?

Access is monetised in predictable ways. Kali365 customers have used compromised accounts for business email compromise, invoice fraud, internal phishing to move laterally and exfiltration of mailbox contents via Graph API. The subscription model means the operator can simply keep paying and keep receiving fresh tokens as long as the flow stays open.

Should you worry if you run a Microsoft 365 tenant?

Yes, and the fix is well within reach. Block the device code flow via Conditional Access unless a documented business case exists for it. Require phishing-resistant authenticators, meaning FIDO2 hardware keys rather than push notifications that users approve while distracted. Monitor sign-in logs for the urn:ietf:params:oauth:grant-type:device_code grant type from unexpected client applications. Revoke refresh tokens aggressively after any suspected compromise: a stolen session will otherwise outlive a password reset by weeks.

The FBI notice reads less like a discovery and more like a reminder that a control Microsoft has been quietly recommending for two years is still off by default in a large share of tenants. Kali365 isn't clever engineering. It's a billing wrapper around an authentication option that administrators forgot they'd enabled.

Common questions

What is OAuth device code authentication?

It's a sign-in flow designed for devices with no browser, like smart TVs, where a user enters a short code on a second device to complete authentication. Attackers abuse it because the code entry looks legitimate and MFA still passes.

Does blocking the device code flow break anything?

For most Microsoft 365 tenants, no. The flow is only needed for specific device types. Microsoft's Conditional Access lets you restrict it to named compliant devices if a genuine use case exists.

Where should incidents be reported?

The FBI asks victims to file a report at ic3.gov, the Internet Crime Complaint Center.