Kali365 PhaaS Hijacks Microsoft 365 Accounts via Device Code Phishing

The FBI is warning organizations about Kali365, a phishing-as-a-service (PhaaS) platform that hijacks Microsoft 365 accounts by abusing OAuth device code authentication. The service bypasses multi-factor authentication (MFA) and has already targeted organizations worldwide. Consequently, security teams should review their Microsoft Entra Conditional Access policies immediately.

What Happened: Kali365 PhaaS Platform Targets Microsoft 365 Accounts

Kali365 first emerged in April 2026 as a subscription-based phishing service sold through Telegram channels. The platform gives cybercriminals advanced tools to compromise Microsoft 365 and Microsoft Entra accounts without stealing passwords or intercepting MFA codes. According to the FBI’s public service announcement (PSA260521), the service has been used in widespread campaigns against organizations across multiple industries.

Security researchers at Arctic Wolf first reported Kali365 activity in April after observing a global campaign that directed victims to Microsoft’s device code login portal. Once victims entered the attacker-generated code and completed MFA, the threat actors captured valid OAuth session tokens. Therefore, even accounts protected by strong MFA were compromised without the attackers ever touching a password.

Kali365 operates as a structured criminal business. Platform admins manage product development, resellers promote the service to other threat actors, and affiliates conduct the actual phishing attacks. Moreover, the service includes AI-generated phishing lures, automated campaign templates, real-time victim-tracking dashboards, and token-capture functionality. Thus, even low-skilled attackers can launch sophisticated campaigns.

Technical Details of the Kali365 Attack

Kali365 exploits Microsoft’s legitimate OAuth 2.0 Device Authorization Grant flow. This authentication method was originally designed for devices with limited input capabilities, such as smart TVs, printers, and IoT equipment. The device code flow allows a user to authenticate on one device by entering a short code at microsoft.com/devicelogin from another device.

Threat actors weaponize this flow in the following manner:

1. The attacker initiates the device authorization process themselves to generate a unique user code.
2. The attacker sends a phishing email or message to the victim containing the code and instructions.
3. The victim visits microsoft.com/devicelogin and enters the code, believing it is a legitimate security verification.
4. The victim completes MFA as part of the normal login flow.
5. Microsoft issues an OAuth access token directly to the attacker’s session.
6. The attacker now has full access to the victim’s account, including Microsoft 365, SharePoint, OneDrive, and any other cloud SaaS platforms connected via single sign-on.

Because the token is issued legitimately through Microsoft’s own infrastructure, traditional security controls often fail to detect the compromise. Furthermore, Kali365 offers a second attack mode called “Cookie Link.” This adversary-in-the-middle (AitM) mode proxies victims through attacker-controlled infrastructure to capture authenticated browser sessions and session cookies after the target completes MFA.

Arctic Wolf observed that compromised accounts were used to create malicious inbox rules designed to hide attacker activity. In some cases, attackers also registered new devices in victims’ Microsoft environments, extending their persistence and making detection more difficult.

Related Threat Actors and Services

Kali365 is not the only platform exploiting device code authentication. Moreover, other PhaaS services have adopted similar tactics in 2026:

• EvilTokens: A newer PhaaS fueling Microsoft device code phishing attacks with automated lure generation.
• Tycoon2FA: A credential-stealing platform that also hijacks Microsoft 365 accounts via device code phishing and adversary-in-the-middle attacks.
• ShinyHunters: An extortion gang that has targeted Microsoft Entra accounts using combined device code and voice phishing (vishing) tactics.

The widespread adoption of device code phishing across multiple criminal services indicates that this technique has become a preferred method for bypassing MFA at scale.

Business and Operational Impact

The impact of Kali365 extends far beyond a single compromised email account. Once an attacker gains valid OAuth tokens, they can access the full breadth of the victim’s cloud environment. Therefore, the business consequences can be severe:

• Data exfiltration: Attackers can access emails, documents, calendars, and collaboration platforms to steal sensitive corporate data, intellectual property, and customer information.
• Business email compromise (BEC): Compromised mailboxes enable invoice fraud, wire transfer scams, and supply chain impersonation attacks.
• Lateral movement: Valid tokens may grant access to additional SaaS platforms, including Salesforce, ServiceNow, and custom business applications connected via SSO.
• Persistence and stealth: Malicious inbox rules and new device registrations help attackers maintain long-term access while evading detection.
• Regulatory and compliance risk: Unauthorized access to regulated data can trigger breach notification requirements, regulatory fines, and reputational damage.

Organizations in sectors such as finance, healthcare, and legal services face especially high stakes. However, any organization using Microsoft 365 with SSO integrations is a potential target.

Mitigation and Recommendations

The FBI and security researchers have published specific guidance to reduce exposure to Kali365 and device code phishing in general. First, organizations should restrict or block the OAuth device code authentication flow where it is not business-critical.

Immediate Actions for Defenders

1. Restrict device code authentication: Use Microsoft Entra Conditional Access policies to block or restrict the device code flow to trusted locations or specific user groups.
2. Audit existing device code usage: Review sign-in logs for device code authentication events and investigate any unexpected usage patterns.
3. Block authentication transfer policies: Disable or restrict policies that allow authentication sessions to move between devices.
4. Monitor for suspicious device registrations: Alert on new device registrations in Microsoft Entra, especially those originating from unusual locations or user agents.
5. Review inbox rules: Audit mailbox rules across the organization for suspicious forwarding, deletion, or categorization rules that could hide attacker activity.
6. Implement session management: Reduce session lifetime and require periodic re-authentication for high-privilege accounts and admin roles.

Detection Guidance

• Alert on device code authentication events from unusual IP addresses, geolocations, or times of day.
• Correlate device code sign-ins with subsequent high-volume email access or data download events.
• Monitor for the creation of inbox rules that forward or delete messages containing keywords such as “invoice,” “payment,” or “wire.”
• Flag new device registrations that do not match the organization’s standard hardware or mobile device management (MDM) profiles.

Bottom line: Kali365 demonstrates how PhaaS platforms have lowered the barrier to entry for MFA-bypass attacks. Organizations must move beyond password and MFA alone and adopt Conditional Access, session monitoring, and device registration controls to defend against token-based compromise.

Incident Summary

Incident:	Kali365 Phishing-as-a-Service (PhaaS) Platform
Affected Systems:	Microsoft 365, Microsoft Entra, and connected SSO-enabled SaaS platforms
Attack Vector:	OAuth device code authentication abuse and adversary-in-the-middle (Cookie Link)
Disclosure Date:	May 21, 2026 (FBI PSA260521)
Active Since:	April 2026
Patch Status:	No software patch required; mitigation relies on configuration and policy changes

References

1. Federal Bureau of Investigation, “FBI Warns of Kali365 Phishing-as-a-Service Platform Targeting Microsoft 365 Accounts,” PSA260521, May 21, 2026, https://www.ic3.gov/PSA/2026/PSA260521.
2. Arctic Wolf, “Token Bingo: Don’t Let Your Code Be the Winner,” April 2026, https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/.
3. Bill Toulas, “FBI warns of Kali365 phishing service targeting Microsoft 365 accounts,” BleepingComputer, May 25, 2026, https://www.bleepingcomputer.com/news/security/fbi-warns-of-kali365-phishing-service-targeting-microsoft-365-accounts/.
4. Microsoft, “OAuth 2.0 device authorization grant flow,” Microsoft Learn, https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-device-code.

SEO Information

SEO Title:	Kali365 PhaaS Hijacks Microsoft 365 Accounts via Device Code Phishing
SEO Slug:	kali365-phaas-microsoft-365-device-code-phishing
Meta Description:	FBI warns Kali365 phishing-as-a-service hijacks Microsoft 365 accounts using OAuth device code authentication. Learn how the attack works and how to defend.
Focus Keyphrase:	Kali365 phishing service