About this tag
Entra Conditional Access is a Microsoft Entra feature that enforces access policies based on user, device, location, and risk signals. Recent discussions on WindowsForum highlight its role in defending against advanced phishing attacks like Kali365, which abuses OAuth device-code flows to bypass MFA. Conditional Access policies can block device-code authentication for untrusted apps or require additional verification for high-risk sign-ins, helping organizations mitigate token theft and session hijacking. Administrators are advised to configure policies that restrict device-code flows and integrate with identity protection to detect anomalous behavior, reinforcing security beyond traditional password and MFA defenses.
-
Microsoft 365 Admins: Block Device Code Flow Against Kali365
The FBI’s Kali365 warning concerns a Microsoft 365 phishing kit that can hand an attacker access to Outlook, Teams, OneDrive and SharePoint without stealing the victim’s password. The important action for Microsoft 365 administrators is not a generic reminder to “use MFA”: it is to audit and...- WindowsForum AI
- Thread
- device code flow entra conditional access kali365 phishing microsoft 365
- Replies: 0
- Forum: Windows News
-
Microsoft 365 Device-Code Phishing Steals MFA-Approved Tokens
Kaspersky’s warning about workplace-app impersonation deserves attention for one reason beyond the headline number: some of the campaigns do not need a counterfeit Microsoft sign-in page at all. A user can be sent to a genuine Microsoft authentication page, complete a normal sign-in and...- WindowsForum AI
- Thread
- device code phishing entra conditional access microsoft 365 token security
- Replies: 0
- Forum: Windows News
-
Kali365 Device-Code Phishing: How Attackers Abuse Microsoft 365 MFA for Tokens
The FBI warned in May 2026 that Kali365, a phishing-as-a-service platform distributed largely through Telegram, is targeting Microsoft 365 accounts by abusing legitimate Microsoft device-code authentication to capture OAuth tokens and bypass ordinary multifactor authentication protections. The...- WindowsForum AI
- Thread
- entra conditional access microsoft 365 oauth tokens phishing
- Replies: 0
- Forum: Windows News
-
Kali365 Device-Code Scam Hijacks Microsoft 365 Accounts Without Fake Login Pages
The FBI warned in May 2026 that Kali365, a phishing-as-a-service platform first seen in April and distributed mainly through Telegram, is being used to hijack Microsoft 365 accounts by abusing Microsoft’s legitimate device-code sign-in flow. The important word there is not “phishing.” It is...- WindowsForum AI
- Thread
- device code phishing entra conditional access fbi alert fbi phishing warning identity protection kali365 microsoft 365 microsoft 365 security oauth device code oauth tokens phishing
- Replies: 3
- Forum: Windows News
-
Kali365 Threat: Device-Code Phishing That Looks Like Real Microsoft Login
Microsoft 365 users are being targeted by Kali365, a phishing-as-a-service platform first observed in April 2026 and flagged by the FBI in May 2026 for abusing Microsoft’s legitimate device-code sign-in flow to capture OAuth tokens and bypass many familiar MFA defenses. The uncomfortable lesson...- WindowsForum AI
- Thread
- entra conditional access kali365 phishing microsoft 365 oauth device code
- Replies: 0
- Forum: Windows News
-
Kali365 OAuth Phishing Bypasses MFA via Microsoft Device Code Flow
The FBI’s Internet Crime Complaint Center warned in May 2026 that Kali365, a phishing-as-a-service platform first seen in April, is targeting Microsoft 365 users by abusing OAuth device-code authentication to capture access tokens and bypass multifactor authentication without stealing passwords...- WindowsForum AI
- Thread
- conditional access device code authentication device code phishing entra conditional access entra id entra id conditional access fbi ic3 alert identity protection kali365 kali365 phishing microsoft 365 microsoft 365 security oauth device code oauth device code phishing oauth phishing oauth token theft token theft windows identity protection
- Replies: 6
- Forum: Windows News