Cybersecurity threats are evolving faster than ever. Over the past decade, organizations have invested heavily in stronger passwords, Multi-Factor Authentication (MFA), endpoint protection, email security, and employee awareness training. As a result, traditional phishing attacks have become more difficult for cybercriminals to execute successfully.

However, attackers are adapting.

Instead of stealing passwords, modern threat actors are increasingly targeting authentication sessions, access tokens, and cloud identity systems.

One of the latest examples of this evolution is Kali365, a newly discovered Phishing-as-a-Service (PhaaS) platform that specifically targets Microsoft 365 users.

In May 2026, the FBI issued a public warning about Kali365, describing it as an emerging cybercrime platform capable of capturing Microsoft OAuth tokens and bypassing Multi-Factor Authentication without intercepting usernames or passwords.

This development is significant because it demonstrates how attackers can gain access to corporate accounts even when organizations have deployed strong password policies and MFA protections.

In this guide, we’ll explain everything you need to know about Kali365, how the attack works, why it is dangerous, how OAuth token theft differs from traditional phishing, and what organizations can do to protect themselves.

What Is Kali365?

Kali365 is a cloud-focused phishing toolkit sold through a subscription-based cybercrime model known as Phishing-as-a-Service (PhaaS).

Rather than building their own phishing infrastructure from scratch, attackers can simply subscribe to Kali365 and gain access to sophisticated tools designed to compromise Microsoft 365 accounts.

Think of it like Netflix for cybercriminals.

Instead of paying for movies, subscribers pay for phishing capabilities.

The platform reportedly began appearing in cybercrime communities and Telegram channels during April 2026.

What makes Kali365 unique is that it focuses on stealing OAuth access tokens rather than passwords.

This means attackers can gain access to Microsoft 365 services without ever seeing the victim’s login credentials.

That dramatically changes how phishing attacks work.

Understanding Phishing-as-a-Service (PhaaS)

Before discussing Kali365 specifically, it helps to understand the concept of Phishing-as-a-Service.

Traditionally, cybercriminals needed technical skills to:

• Create phishing websites
• Host malicious pages
• Design fake login portals
• Manage infrastructure
• Collect stolen credentials
• Evade security detection

Today, much of that work has been commercialized.

Cybercrime groups now develop phishing platforms and rent them to other criminals.

Subscribers receive ready-made tools, templates, dashboards, and support.

Common PhaaS features include:

• Pre-built phishing pages
• Automated email campaigns
• Victim tracking systems
• Credential collection portals
• Technical support
• Analytics dashboards
• AI-generated phishing messages

This dramatically lowers the barrier to entry.

Someone with very little technical knowledge can launch large-scale phishing campaigns within hours.

Kali365 takes this concept a step further by automating Microsoft 365 token theft.

Why Microsoft 365 Is a Major Target

Microsoft 365 has become one of the most widely used business productivity platforms in the world.

Organizations rely on it for:

• Email communication
• Team collaboration
• File storage
• Video conferencing
• Document sharing
• Enterprise workflows

Popular Microsoft 365 services include:

• Outlook
• Teams
• OneDrive
• SharePoint
• Exchange Online
• Word
• Excel
• PowerPoint

Because these services often contain sensitive business information, they are attractive targets for cybercriminals.

Compromising a single Microsoft 365 account can provide access to:

• Customer information
• Financial records
• Internal communications
• Business contracts
• Intellectual property
• Confidential documents

For attackers, Microsoft 365 accounts are digital goldmines.

Why Traditional Phishing Usually Fails Against MFA

Historically, phishing attacks attempted to steal usernames and passwords.

A typical attack looked like this:

1. Victim receives a phishing email.
2. Victim clicks a malicious link.
3. Fake login page appears.
4. Victim enters credentials.
5. Attacker steals username and password.

Years ago, this approach was extremely effective.

Today, many organizations use Multi-Factor Authentication.

Even if attackers obtain a password, they still need:

• A mobile approval request
• Authentication app code
• Security key
• Biometric verification

This extra layer often prevents account compromise.

Because of MFA adoption, attackers have started looking for new methods.

That is where Kali365 enters the picture.

What Is OAuth?

To understand Kali365, you first need to understand OAuth. OAuth is an authorization framework used by Microsoft and many other technology companies.

Its purpose is to allow applications to access resources without repeatedly asking users for passwords.

For example:

When you connect a third-party application to your Microsoft account, Microsoft doesn’t share your password.

Instead, Microsoft issues special digital credentials called tokens. These tokens act as temporary authorization keys. The application uses those tokens to access approved resources. This improves security because passwords are not constantly shared between systems.

What Are OAuth Access Tokens?

An OAuth access token is essentially a temporary permission slip.

Think of it like a visitor badge at a secure office building.

Instead of carrying your identity documents everywhere, you receive a badge granting access to specific areas.

Similarly, an access token grants temporary access to:

• Outlook emails
• Teams chats
• OneDrive files
• SharePoint resources

As long as the token remains valid, systems trust it.

No additional password is required.

What Are Refresh Tokens?

• Refresh tokens are even more powerful.
• When an access token expires, a refresh token can request a new one.
• This allows users to remain signed in without repeatedly entering passwords.
• Unfortunately, attackers love refresh tokens.
• If stolen, they can continuously generate new access tokens and maintain long-term account access.
• This is exactly what Kali365 aims to steal.

How Kali365 Attacks Work

The attack process is surprisingly simple.

Many victims never realize anything suspicious occurred.

Let’s break it down step by step.

Stage 1: Phishing Email Delivery

The attack begins with a carefully crafted phishing email.

The email often impersonates trusted services such as:

• Microsoft
• OneDrive
• Teams
• SharePoint
• Cloud document platforms

The message may claim:

• “Someone shared a document with you.”
• “Your file requires review.”
• “Urgent approval needed.”
• “New Teams collaboration request.”
• The goal is to create urgency and curiosity.
• Unlike traditional phishing emails, victims are not directed to a fake login page.
• Instead, they receive a device authentication code.
• This makes the attack appear more legitimate.

Stage 2: The Victim Visits a Real Microsoft Website

• This is where the attack becomes dangerous.
• The email instructs the victim to visit a legitimate Microsoft verification page.
• The website is real.
• The domain is real.
• The SSL certificate is real.
• Everything looks authentic because it actually is.
• Most users have been trained to look for fake websites.
• In this case, there isn’t one.
• The victim arrives at Microsoft’s genuine authentication portal.

Stage 3: Device Code Entry

The victim enters the code provided in the phishing email.

From the user’s perspective, they are simply verifying access to a document or service.

In reality, that code is linked to an authentication request initiated by the attacker.

By entering the code, the victim unknowingly approves the attacker’s device.

Stage 4: Legitimate MFA Completion

The victim now completes MFA.

They may:

• Approve a mobile notification
• Enter an authenticator code
• Use a security key

Everything appears normal.

Microsoft sees a legitimate user successfully authenticating.

No alarms are triggered.

No passwords are stolen.

No malware is installed.

Yet the attacker is about to gain account access.

Stage 5: OAuth Token Theft

Once authentication succeeds, Microsoft issues OAuth tokens.

Instead of the victim’s device receiving those tokens, the attacker receives them.

The stolen tokens may include:

• Access tokens
• Refresh tokens

At this point, the attacker effectively possesses the digital keys to the account.

Stage 6: Persistent Microsoft 365 Access

Using the stolen tokens, attackers can access:

• Outlook
• Teams
• OneDrive
• SharePoint
• Exchange Online

Most importantly, they often do not need to complete MFA again. The tokens have already proven authentication occurred. This is why Kali365 is often described as an MFA bypass tool. Technically, MFA wasn’t broken. The attacker simply tricked the victim into completing it on their behalf.

Why Kali365 Is So Dangerous

Several factors make Kali365 particularly concerning.

It Uses Legitimate Microsoft Infrastructure

Most phishing attacks rely on fake websites.

Kali365 leverages real Microsoft services.

This eliminates many warning signs users normally look for.

No Password Theft Required

Traditional security awareness training focuses heavily on password protection.

Kali365 doesn’t need passwords.

Users can keep their passwords secret and still become victims.

MFA Cannot Detect the Trick

The victim willingly completes MFA.

As far as Microsoft is concerned, authentication occurred successfully.

Long-Term Access Is Possible

Refresh tokens may allow attackers to maintain persistence for extended periods.

This increases the likelihood of data theft and business compromise.

Low-Skilled Criminals Can Use It

Because Kali365 is sold as a service, attackers do not need advanced expertise.

This increases the number of threat actors capable of launching sophisticated attacks.

What Can Attackers Do After Accessing a Microsoft 365 Account?

The consequences can be severe.

Attackers may:

• Read emails
• Download attachments
• Monitor conversations
• Steal files
• Access Teams chats
• Harvest business intelligence
• Conduct invoice fraud
• Launch internal phishing campaigns

Some attackers remain hidden for weeks or months.

They quietly observe communications before executing financial fraud schemes.

How Organizations Can Protect Themselves

The FBI recommends several defensive measures.

Restrict Device Code Authentication

Organizations should evaluate whether device code authentication is truly necessary.

If not required, disable it.

Reducing available authentication methods reduces attack opportunities.

Deploy Conditional Access Policies

Conditional Access allows organizations to enforce security controls based on:

• User identity
• Device health
• Location
• Risk level
• Authentication method

Blocking device code flow is one of the most effective mitigations.

Audit OAuth Permissions

Regularly review:

• Enterprise applications
• User consent grants
• OAuth permissions
• Connected third-party services

Remove unnecessary access immediately.

Monitor Sign-In Activity

Security teams should analyze:

• Login locations
• Device information
• Session activity
• Authentication methods

Unusual behavior may indicate token theft.

Strengthen User Awareness Training

Employees should understand that:

A real Microsoft page does not automatically mean a request is legitimate.

Authentication codes should never be entered simply because an email instructs them to do so.

Users must verify requests independently.

Warning Signs of a Kali365 Compromise

Potential indicators include:

• Unknown devices appearing in accounts
• Unexpected login locations
• Suspicious Teams activity
• New email forwarding rules
• Unauthorized OAuth applications
• Strange file access patterns
• Unexplained account behavior

Any of these signs should trigger an immediate security investigation.

What To Do If You Have Been Targeted

If you suspect compromise:

1. Revoke all active sessions.
2. Remove unauthorized devices.
3. Review OAuth grants.
4. Reset credentials.
5. Investigate sign-in logs.
6. Notify your security team.
7. Monitor email activity.
8. Review file access records.

Fast response can significantly reduce damage.

The Bigger Cybersecurity Trend Behind Kali365

Kali365 is part of a broader shift in cybercrime.

Attackers are moving away from password theft.

Instead, they increasingly target:

• Identity systems
• Session tokens
• Authentication workflows
• Cloud environments
• User consent mechanisms

As organizations improve password security, attackers focus on whatever remains trusted.

Today, that trust often resides in tokens.

Tomorrow’s security strategies must protect identities, sessions, permissions, and authorization systems—not just passwords.

Conclusion

Kali365 represents a major evolution in phishing attacks. Rather than stealing passwords, it exploits legitimate Microsoft authentication processes to capture OAuth tokens and gain persistent access to Microsoft 365 accounts.

Because victims authenticate through real Microsoft pages and complete legitimate MFA challenges, traditional security awareness practices may not be enough.

Organizations should immediately review device code authentication usage, strengthen Conditional Access policies, audit OAuth permissions, monitor authentication logs, and educate users about token-based phishing attacks.

The emergence of Kali365 demonstrates a critical reality of modern cybersecurity: protecting passwords is no longer sufficient. Protecting authentication tokens, user consent workflows, and cloud identities has become equally important.