← Back to SecLog

FBI warns Kali365 phishing service is hijacking Microsoft 365 accounts through OAuth device-code logins

Updated: 2026.07.01 25D ago 5 sources
Scams & Fraud Social Engineering & Phishing
The FBI says criminals are using a Telegram-based service called Kali365 to trick people into granting access to their Microsoft 365 accounts. The phishing-as-a-service platform, first seen in April 2026, abuses Microsoft's legitimate device-code login flow so victims authorize attacker-initiated sessions; the stolen OAuth access and refresh tokens can then be reused to access Outlook, Teams and OneDrive without needing the victim's password or another multi-factor authentication prompt.
Why it matters: This matters because victims can lose control of email, files and collaboration accounts even if multi-factor authentication is enabled. Organizations using Microsoft 365 should urgently review device-code login controls and token protections, monitor for suspicious inbox rules and token use, and warn users not to enter login codes from unsolicited emails.

Sources

EvilTokens device-code phishing kit totally more evil than we all thought
2026.07.01 42% relevant
This article covers the same broad device-code phishing tradecraft against Microsoft 365 and adds new details on the EvilTokens/ARToken operator panel, targeted invoice lures, SharePoint lookalike links, anti-analysis features, and built-in post-compromise business email compromise capabilities. It is not the Kali365 service specifically, but it is a closely related update in the same Microsoft 365 OAuth device-code phishing wave.
From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook, Okta, Xerox DocuShare, and Other Services
Arctic Wolf Labs 2026.06.02 94% relevant
This is the same underlying Kali365 operation and device-code phishing activity, but with substantive new details: Arctic Wolf links the operator to 126 malicious hosts, shows panel and token-capture infrastructure, and says the campaign has expanded beyond Microsoft 365 lures to Okta, Xerox DocuShare, GMX, Mail.ru, Yandex Disk, Odnoklassniki, and MAX Messenger account-takeover pages.
From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook, Okta, Xerox DocuShare, and Other Services
Arctic Wolf Labs 2026.06.02 97% relevant
This is a direct follow-up on the same Kali365 operation: it adds new technical detail about the operator’s infrastructure, a cluster of 126 malicious hosts, and expansion beyond Microsoft 365-themed lures into Outlook, Okta, Xerox DocuShare, AWS-themed pages, and a MAX Messenger account-takeover campaign while continuing to abuse Microsoft OAuth device authorization to bypass MFA.
FBI warns of Kali365 phishing service targeting Microsoft 365 accounts
Lawrence Abrams 2026.05.25 99% relevant
This article is the same underlying event: the FBI public warning on Kali365. It adds detail on Kali365's Telegram-based distribution, its two attack modes including the adversary-in-the-middle 'Cookie Link' option, links to prior Arctic Wolf reporting, and the FBI's recommended mitigations such as restricting device-code authentication and reviewing unauthorized device registrations.
FBI warns of Kali365 phishing-as-a-service after April Microsoft 365 attacks
2026.05.22 100% relevant
This article establishes a distinct tracked story by tying April 2026 Microsoft 365 account-takeover campaigns to the specific Kali365 phishing-as-a-service platform and adding the FBI's public warning plus operational details on how the abuse works.
← Back to all stories