The FBI has issued a warning about Kali365, a phishing-as-a-service platform that targets Microsoft 365 accounts and can bypass multi-factor authentication (MFA). The scam, which first appeared in April 2024 and has spread largely through Telegram, allows attackers to gain access to accounts without stealing passwords.

The Kali365 platform provides subscribers with AI-generated phishing messages, automated campaign templates, tracking dashboards, and tools to capture OAuth tokens. These tokens act as digital access keys, allowing applications to remain connected to an account without repeated password prompts. When stolen by malicious actors, these tokens can grant unauthorized access to services like Outlook, Teams, and OneDrive.

How the Scam Works

Unlike traditional phishing scams that aim to steal passwords, Kali365 exploits Microsoft's legitimate device code login process. Attackers initiate a sign-in from their own device and then send a phishing email to the victim, impersonating a trusted service. This email includes a code and directs the victim to a seemingly legitimate Microsoft verification page.

When the victim enters the code on the fake page, they unknowingly authorize the attacker's device. The attacker can then capture access and refresh tokens, enabling them to access the victim's Microsoft 365 services. This method can deceive users even when MFA is enabled because the approval comes from what appears to be a legitimate Microsoft verification process.

Impact on Users and Businesses

The FBI notes that any Microsoft 365 user can be a target. However, small businesses are particularly vulnerable. A compromised work account can provide attackers with sensitive information such as email threads, invoices, shared files, employee communications, and customer details. Attackers can then use this information to craft highly convincing emails from the compromised account, tricking colleagues into paying fake invoices or sharing sensitive data.

Red Flags and Protection Measures

Users should be wary of unexpected requests to enter a Microsoft device code, especially if prompted via email, Teams message, or a link for a document they did not request. Scammers often create a sense of urgency, claiming documents are expiring or accounts need immediate verification. The FBI advises against entering a device code if you did not initiate the sign-in process.

Microsoft recommends following FBI guidance and its own best practices. Key protective measures include:

  • Never entering a device code unless you personally initiated the sign-in.
  • Going directly to Microsoft's website or your company's portal instead of clicking links in unexpected messages.
  • Regularly checking account activity for unrecognized sign-ins, devices, or active sessions.
  • Revoking suspicious sessions and changing passwords if an entry is suspected.
  • Keeping MFA enabled, as it still blocks many other types of attacks.
  • Using strong antivirus software to detect malicious links.
  • Training employees to recognize device-code scams.
  • Businesses can consider restricting device code flow via conditional access policies, after auditing current usage to identify legitimate business needs.

If a user believes they have entered a code by mistake, they should immediately sign out of Microsoft 365 on all devices, change their password, check recovery information, review email forwarding rules, and examine OneDrive and Teams for suspicious activity. For work accounts, reporting the incident to the IT department immediately is crucial.