FBI Warns of Kali365 Phishing Platform Targeting Microsoft 365 Accounts
Summary
The FBI warns that Kali365 uses OAuth device-code phishing to capture Microsoft 365 tokens that can enable persistent account access. Proofpoint and Arctic Wolf report growing activity involving these tools.
Key points
- The FBI says Kali365 uses phishing lures and OAuth device-code authorization to obtain Microsoft 365 access tokens while bypassing MFA.
- Victims must copy and paste a code to authorize a malicious application; the article says the process involves fewer steps than credential-and-MFA-code phishing.
- The FBI says Kali365 is primarily distributed on Telegram and offers AI-generated lures, campaign templates, tracking dashboards, and token capture capabilities.
- Captured access and refresh tokens are stored on the platform and, according to Arctic Wolf researchers, can be shared or reused by other attackers.
- The FBI warns that the tokens can provide persistent access across Microsoft services without a password or additional MFA requests.
- Proofpoint observed seven similar device-code phishing tools in a 10-day period and reported a sharp increase in activity beginning in February.
Article Details
- Event Type
- FBI public warning about Kali365, a growing phishing-as-a-service platform targeting Microsoft 365 accounts through device-code authorization abuse.
- Impact
- Stolen OAuth access and refresh tokens can provide persistent access to victim accounts and Microsoft services without a password or additional MFA requests. The FBI warns this access can enable data theft, fraud, extortion, and ransomware activity.