![\"Kali365](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/05\/phishing_650.webp\" "\\"Phishing\\"\/")
<\/p>\nMicrosoft 365 access tokens are being targeted by an emerging Phishing-as-a-Service (PhaaS) platform called Kali365, the FBI is warning.<\/p>\n
<\/p>\n
First observed in April 2026, Kali365 has been distributed through Telegram<\/a>, allowing cybercriminals to obtain Microsoft 365 access tokens and bypass MFA without stealing user credentials.<\/p>\n \u201cKali365 lowers the barrier of entry, providing less-technical attackers access to AI-generated phishing lures, automated campaign templates, real-time targeted individual\/entity tracking dashboards, and OAuth token capture capabilities,\u201d the FBI said.<\/p>\n This type of attack is known as device code phishing, where attackers trick users into logging into their accounts through a legitimate authentication flow and then steal their access and refresh tokens.<\/p>\n How the attack works<\/p>\n The attack starts with a phishing email that impersonates trusted cloud or document-sharing services and includes a device code with instructions to visit a legitimate Microsoft verification page. <\/p>\n After the victim enters the code, they unknowingly authorize the attacker\u2019s device. <\/p>\n The attacker then captures OAuth access<\/a> and refresh tokens, allowing continued access to Microsoft 365 services such as Outlook, Teams, and OneDrive without requiring a password or additional MFA prompts.<\/p>\n In its announcement, the FBI outlined several tips<\/a> users and organizations can follow to protect themselves from device code phishing attacks.<\/p>\n Telegram-based phishing services<\/p>\n