The FBI has issued an urgent warning over a fast-spreading phishing campaign that is targeting users of Microsoft 365 services, including Outlook, Microsoft Teams, and OneDrive. The scam is powered by a cybercrime toolkit known as 'Kali365', which is enabling attackers to bypass traditional security protections, including multifactor authentication, without ever needing to steal a password.
Instead, victims are tricked into authorising access through legitimate Microsoft login processes, making the phishing attack far more difficult to detect. Security researchers say the campaign is already spreading quickly, raising concerns that millions of users could be exposed to account takeover attempts that leave no obvious trace of compromise.
