FBI warns of Kali phishing scam hitting Microsoft OAuth tokens — warns 'Kali365 lowers the barrier of entry, providing less-technical attackers access to AI-generated phishing lures'

A fish hook is lying across a computer keyboard, representing a phishing attack on a computer system.

• FBI flags Kali365, a phishing kit sold on Telegram which steals Microsoft 365 OAuth tokens and bypasses MFA
• Victims are tricked into entering device codes on legitimate Microsoft pages, unknowingly authorizing attacker access to Outlook, Teams, and OneDrive
• Mitigation steps include restricting device code flow, enforcing conditional access policies, auditing usage, and blocking authentication transfer policies

The FBI has warned of a new phishing kit which “lowers the barrier of entry” and allows even low-skilled malicious actors an easy way to compromise people’s Microsoft 365 accounts.