cyber.hendryadrian.com
Security News · therecord.media

FBI Warns Kali365 Phishing Service Bypasses MFA to Access Microsoft 365

· Original article ↗

Summary

The FBI warns that Kali365, a Telegram-based phishing service, captures Microsoft 365 OAuth tokens to bypass MFA. Security firms reported hundreds of related attacks, and Arctic Wolf described post-compromise mailbox activity.

Key points

  • The FBI says Kali365 has been used since April 2026 and provides phishing-as-a-service capabilities through Telegram.
  • The service uses phishing lures to trick victims into authorizing attacker-initiated sessions through Microsoft's legitimate device login flow.
  • Captured OAuth access and refresh tokens can provide access to Outlook, Teams, and OneDrive without a password or additional verification.
  • Arctic Wolf reported that attackers used captured tokens for mailbox access and, in some cases, created malicious inbox rules to suppress security notifications.
  • Arctic Wolf said Kali365 offered three subscription tiers, priced from $250 for 30 days to $2,000 for 365 days.
  • The FBI and security firms describe Kali365 as part of a broader ecosystem of services enabling similar phishing campaigns.

Article Details

Event Type
FBI warning about Kali365, a Telegram-based phishing-as-a-service platform used in Microsoft 365 OAuth token phishing attacks.
Impact
The platform captures OAuth access and refresh tokens, enabling attackers to bypass MFA and gain unauthorized access to Microsoft 365 accounts without passwords or additional verification. Reported post-compromise activity includes mailbox access, contact harvesting, lateral phishing, business email compromise monitoring, and, in some cases, malicious inbox rules that suppress security notifications. Administrative actions may be possible when a captured token has sufficient privileges.

MITRE ATT&CK

T1528 · Steal Application Access TokenKali365 captures OAuth access and refresh tokens that attackers reuse to access Microsoft 365 accounts.

Vendors

MicrosoftThe FBI warns that Kali365 is a Telegram-based phishing-as-a-service platform used to capture OAuth tokens and bypass MFA to gain unauthorized access to Microsoft 365 accounts.

Products

Microsoft 365 Apps for EnterpriseThe FBI warns that Kali365 is a Telegram-based phishing-as-a-service platform used to capture OAuth tokens and bypass MFA to gain unauthorized access to Microsoft 365 accounts.Microsoft OneDriveThe service is enabling large-scale attacks against Outlook, Teams, and OneDrive by using branded phishing lures, automated campaigns, and reusable access tokens.OutlookThe service is enabling large-scale attacks against Outlook, Teams, and OneDrive by using branded phishing lures, automated campaigns, and reusable access tokens.TeamsThe service is enabling large-scale attacks against Outlook, Teams, and OneDrive by using branded phishing lures, automated campaigns, and reusable access tokens.

Tools

Kali365The FBI warns that Kali365 is a Telegram-based phishing-as-a-service platform used to capture OAuth tokens and bypass MFA to gain unauthorized access to Microsoft 365 accounts.

Related Articles