kali365 phishing

Kali365 is a phishing-as-a-service kit first observed in April 2026, which the FBI publicly warned about in May 2026. It targets Microsoft 365 users by abusing OAuth device-code authentication to capture access tokens for Outlook, Teams, and OneDrive, bypassing multifactor authentication without stealing passwords. The attack does not use fake login pages; instead, it tricks users into completing a legitimate Microsoft sign-in flow for an attacker-controlled device. For Windows and Microsoft 365 administrators, Kali365 highlights that MFA alone is insufficient and that identity security requires hardening authentication workflows beyond traditional password protection.