oauth token theft

OAuth token theft is a growing threat in Microsoft 365 environments, as demonstrated by the Kali365 phishing-as-a-service platform. This attack abuses the legitimate OAuth device-code authentication flow to capture access tokens, bypassing multifactor authentication without requiring victims to enter passwords. Instead, users are tricked into completing a real Microsoft sign-in on an attacker-controlled device. The FBI issued a public warning in May 2026 about Kali365, highlighting that traditional anti-phishing advice like checking URLs is insufficient. For WindowsForum readers, this underscores the need to harden identity infrastructure with the same rigor applied to firewalls and endpoints, as MFA alone is no longer a complete defense against token theft.