FBI flags Kali365, the latest phishing kit pitched at draining Microsoft 365 tenants

The FBI has issued a public advisory warning that a phishing-as-a-service platform called Kali365 is being used to compromise Microsoft 365 accounts at scale, abusing OAuth device code authentication to capture session tokens and sidestep multi-factor authentication. The notice, published this week by the bureau's Internet Crime Complaint Center, describes a turnkey kit sold on subscription to operators who otherwise lack the patience to build their own infrastructure.

Kali365 sits in the same lineage as EvilProxy, Greatness and Tycoon 2FA. The novelty, such as it is, lies in the social-engineering flow rather than the cryptography. Victims receive a lure pointing at a real Microsoft login page; the operator, having initiated a device code grant on the back end, prompts the target to enter a short code. Microsoft duly issues a session token to the attacker's device. MFA completes successfully, because from Entra ID's perspective nothing is wrong.

The technique is documented. Volexity wrote it up against Russian state activity earlier this year, and Microsoft's own identity engineering guidance has, for some time, suggested blocking the device code flow via Conditional Access where it is not actively needed. Most tenants do not need it. Many leave it on regardless.

The FBI says Kali365 customers have used the access for the usual catalogue: business email compromise, invoice fraud, internal phishing to move laterally, and exfiltration of mailbox contents via Graph API. Pricing, per the advisory, runs in tiers, with the higher tiers bundling anti-bot pages and geofencing to keep researchers out.

And the defensive picture is familiar. Block the device code flow unless a documented use case exists. Require phishing-resistant authenticators, meaning FIDO2 or certificate-based, rather than push notifications that users will approve while making tea. Monitor sign-in logs for the urn:ietf:params:oauth:grant-type:device_code grant type from unexpected client applications. Revoke refresh tokens aggressively after any suspected compromise, because a stolen session will otherwise outlive the password reset by weeks.

None of this is new advice. The FBI notice reads, predictably, less like a discovery and more like a reminder that a control Microsoft has been quietly recommending for two years is still off by default in a large share of tenants. Kali365 is not a clever piece of engineering. It is a billing wrapper around an authentication option that administrators forgot they had enabled.

The bureau asks victims to report incidents to ic3.gov. The kit's operators, one suspects, will read the advisory with interest.