FBI Warns of New Scam Hijacking Microsoft 365 Accounts

The FBI has issued an urgent warning to Microsoft 365 users, including those who use Outlook and Microsoft Teams, regarding a new hacking service that bypasses common security measures. The agency stated in a Public Service Announcement that cybercriminals are utilizing a platform known as Kali365 to gain access to accounts through sophisticated phishing attacks.

These attacks involve hackers sending victims emails that appear to originate from trusted services. The emails direct users to a legitimate Microsoft login page. Once a victim follows the instructions and enters their credentials, attackers can capture special authentication tokens. These tokens function similarly to a digital pass, allowing unauthorized access to services like Outlook, Teams, and OneDrive without requiring repeated password entry or additional multi-factor authentication.

How the Scam Works

The Kali365 platform, reportedly sold to scammers for $250 per month, provides tools that lower the barrier to entry for less technically proficient attackers. These tools include AI-generated phishing lures, automated campaign templates, tracking dashboards, and OAuth token capture capabilities. The attack begins when a phishing email containing a device code and instructions is sent to the victim. The victim is then directed to a legitimate Microsoft verification page where they enter the code, unknowingly authorizing the attacker's device to access their account.

Once the OAuth access and refresh tokens are stolen, cybercriminals can maintain persistent access to the user's Microsoft 365 account. The FBI noted that because these tokens are issued after a successful login, they can often bypass two-factor authentication, enabling extended access periods.

FBI Recommendations

To combat this threat, the FBI is urging organizations to block a Microsoft authentication feature known as 'device code flow,' which is being exploited by attackers. However, businesses are advised to first review how this feature is used internally to avoid disrupting legitimate services and workflows. For organizations that cannot disable device code flow entirely, the FBI recommends exempting emergency access accounts to ensure administrators retain access to critical systems.

The agency also advises users to be vigilant against fraudulent emails by carefully checking sender addresses, links, and the wording of messages for signs of phishing attempts. Users should refrain from clicking on links containing access codes they did not request.

The FBI encourages users to report phishing emails, suspicious login attempts, and any unauthorized devices or active sessions linked to their accounts to the Internet Crime Complaint Center.