device code phishing

Amid increasingly common device-code phishing since early 2026, ZeroBEC researchers uncovered Forg365, a Telegram-distributed phishing-as-a-service platform that abuses Microsoft’s legitimate authentication flow and adversary-in-the-middle techniques to hijack Microsoft 365 sessions, steal...

Cisco Talos has identified ARToken, a React-based operator panel tied by infrastructure and API behavior to the EvilTokens phishing-as-a-service ecosystem, exposing more than 80 endpoints for Microsoft 365 device-code phishing, token persistence, mailbox abuse, BEC operations, and SharePoint...

The FBI warned on May 21, 2026, that Kali365, a phishing-as-a-service platform first observed in April, is targeting Microsoft 365 users by abusing legitimate device-code sign-ins to capture OAuth tokens for Outlook, Teams, OneDrive, and other cloud services without stealing passwords. The...

The FBI warned in May 2026 that Kali365, a phishing-as-a-service platform first seen in April and distributed mainly through Telegram, is being used to hijack Microsoft 365 accounts by abusing Microsoft’s legitimate device-code sign-in flow. The important word there is not “phishing.” It is...

The FBI’s Internet Crime Complaint Center warned in May 2026 that Kali365, a phishing-as-a-service platform first seen in April, is targeting Microsoft 365 users by abusing OAuth device-code authentication to capture access tokens and bypass multifactor authentication without stealing passwords...

The FBI issued a May 2026 public warning that Kali365, a phishing-as-a-service platform first seen in April 2026, is being used to hijack Microsoft 365 access tokens and reach Outlook, Teams, and OneDrive accounts without directly stealing passwords. That is the uncomfortable point: the fake...

The FBI issued a May 21, 2026 public warning that a phishing-as-a-service platform called Kali365 is targeting Microsoft 365 accounts by abusing device-code authentication to capture OAuth tokens and bypass multi-factor authentication. That makes this less a story about one new phishing kit than...

In the ever-changing landscape of cybersecurity, enterprises face an adaptable and relentless adversary: the identity-focused attacker. As organizations increasingly move to the cloud, adopt modern authentication, and enforce multifactor authentication (MFA), the techniques used by...

Russian cyber threat actors have recently exploited OAuth 2.0 authentication flows to compromise Microsoft 365 accounts belonging to employees involved with Ukraine-related and human rights organizations. This sophisticated attack, tracked since early 2025, is predominantly attributed to...

In recent weeks, Microsoft 365 users have found themselves in the crosshairs of a sophisticated business email compromise (BEC) campaign that exploits the cloud service’s very reputation for trust and reliability. Rather than launching the usual barrage of phishing emails filled with tyrannical...

Published: February 17, 2025 In a sophisticated cyberattack that underscores the evolving threat landscape, Microsoft’s Threat Intelligence Center has uncovered a long-running campaign by Russian hackers intent on stealing Microsoft 365 accounts. Using a clever twist on the device code...

In today’s digital battleground, where identity is the new perimeter, Microsoft Entra continues to be the frontline for securing your organization’s most valuable asset—its users. In the latest roundup, Entra.News has shone a spotlight on some alarming developments, most notably the emerging...

In a startling development that reads like a spy thriller, cybercriminals—allegedly with Kremlin ties—are exploiting Microsoft Teams invites to wage a sophisticated phishing campaign. If you've ever felt a twinge of apprehension upon receiving an unexpected Teams meeting invitation, you may well...

A clever new breed of phishing scam is on the rise and it's catching even the savviest users off guard. Researchers have uncovered a sustained campaign where Russian spies are using a technique known as "device code phishing" to gain unauthorized access to Microsoft 365 accounts. Windows users...