oauth device code

The FBI warned in May 2026 that Kali365, a phishing-as-a-service platform first seen in April and distributed mainly through Telegram, is being used to hijack Microsoft 365 accounts by abusing Microsoft’s legitimate device-code sign-in flow. The important word there is not “phishing.” It is...

A newly reported phishing campaign is abusing legitimate Microsoft 365 Groups, Outlook calendar invitations, shared files, and cloud authentication workflows in 2026 to reach corporate users through trusted collaboration surfaces rather than traditional spoofed email, according to security...

The FBI issued a May 21, 2026, public warning that Kali365, a phishing-as-a-service kit first seen in April 2026, is targeting Microsoft 365 users by abusing OAuth device-code sign-ins to seize access tokens for Outlook, Teams, and OneDrive without stealing passwords. This is not another clumsy...

The FBI’s Internet Crime Complaint Center warned in May 2026 that Kali365, a phishing-as-a-service platform first seen in April, is targeting Microsoft 365 users by abusing OAuth device-code authentication to capture access tokens and bypass multifactor authentication without stealing passwords...

The FBI issued a May 21, 2026 public warning that a phishing-as-a-service platform called Kali365 is targeting Microsoft 365 accounts by abusing device-code authentication to capture OAuth tokens and bypass multi-factor authentication. That makes this less a story about one new phishing kit than...