FBI IC3 PSA: Kali365 Phishing-as-a-Service Kit Hijacks Microsoft 365 Access Tokens

www.ic3.gov • August 7, 2026

The Federal Bureau of Investigation ( FBI ) is issuing this Public Service Announcement ( PSA ) to warn the public an emerging Phishing 1 -as-a-Service 2 ( PhaaS ) platform called Kali365, first seen in April 2026. Kali365 has primarily been distributed via Telegram, enabling cyber threat actors to obtain Microsoft 365 access tokens and bypass multi-factor authentication 3 ( MFA ) protocols without intercepting the user's credentials.

Through the Kali365 platform subscription, cyber threat actors can capture "OAuth" tokens and gain persistent access to targeted individuals/entities' Microsoft 365 environments. Kali365 lowers the barrier of entry, providing less-technical attackers access to AI-generated phishing lures, automated campaign templates, real-time targeted individual/entity tracking dashboards, and OAuth token capture capabilities.

Restricting device code flow to limit or block device authentication codes can help prevent or limit this style of attack.

If you or someone you know has been impacted by the Kali365 Phishing kit, file a complaint with the Internet Crime Complaint Center ( IC3 ) at . Be sure to include any available information, such as:

Please see the Cybersecurity & Infrastructure Security Agency's ( CISA ) Phishing Guidance: Stopping the Attack Cycle at Phase One, which provides best practices and mitigations to protect against phishing techniques.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

FBI Warns of Kali365 Phishing Kit Targeting Microsoft 365 Users The FBI has issued a warning regarding the Kali365 phishing kit, which is actively stealing Microsoft OAuth tokens and bypassing multi-factor authentication (MFA) protocols. First identified in April 2026, Kali365 is marketed as a Phishing-as-a-Service (PhaaS) platform on Telegram, enabling less-technical attackers to execute phishing campaigns. The attack method involves sending emails that impersonate trusted cloud services, instructing victims to enter a device code on a legitimate Microsoft page, thereby granting attackers access to their accounts without needing credentials. This poses significant risks to organizations, including potential data theft and corporate espionage. The FBI has recommended creating conditional access policies and blocking authentication transfer policies to mitigate the threat. The rise of Kali365 adds to the growing concerns over phishing attacks, which 77% of organizations believe have increased in the past year. 135 sources 73

Extracted Entities

FBI IC3 PSA: Kali365 Phishing-as-a-Service Kit Hijacks Microsoft 365 Access Tokens

The full story

Extracted Entities

Attack Types (1)

Domains (1)

MITRE ATT&CK (1)

Platforms (2)

Tools (1)