FBI Flags Kali365 as New Phishing Threat Targeting Microsoft 365 Users
ID: 2b8e30a3-51d1-5ea3-be40-90d3ecac35e7
STIX ID: report--2b8e30a3-51d1-5ea3-be40-90d3ecac35e7
Feed Name: The Cyber Express
Threat Score
**FBI warns of Kali365, a Phishing‑as‑a‑Service that hijacks Microsoft 365 accounts by stealing OAuth tokens via the device code authentication flow (bypassing MFA); the platform surfaced in April 2026, is distributed via Telegram, is tied to hundreds of campaigns, and the FBI recommends blocking or restricting device code flows, auditing authentication workflows, and reporting incidents to IC3.**
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.