FBI: Kali365 Phishing Kit is Targeting Microsoft 365 Accounts

The FBI warns of Kali365, a phishing-as-a-service platform that uses OAuth device code flows to capture access and refresh tokens and gain persistent access to Microsoft 365 services without stealing credentials or bypassing MFA. The report describes the attack chain—phishing lure with a device code, victims entering the code on a legitimate Microsoft verification page, attackers capturing tokens—and recommends locking down device code authentication and conducting employee phishing awareness training.