Back Ground.News

Microsoft 365 Users Targeted by New Phishing Threat that Bypasses MFA

Ground.News • May 22, 2026

The FBI has issued a public service announcement warning a new phishing kit that's stealing Microsoft OAuth tokens at an alarming rate. OAuth token theft is a serious headache for organizations because stolen tokens can bypass multi-factor authentication (MFA) and grant access to privileged accounts within an organization without needing to know their credentials. Think corporate espionage, data theft, maybe even ransomware. The main culpr…

Kali365 is targeting Microsoft 365 users through device code phishing, using OAuth token theft and Telegram-based distribution.

The U.S. Federal Bureau of Investigation (FBI) has issued a Public Service Announcement (Alert I-052126-PSA) warning a newly identified Phishing-as-a-Service (PhaaS) platform named Kali365, which is actively targeting Microsoft 365 users. First observed in April 2026, the platform enables attackers to bypass multi-factor authentication (MFA) by exploiting OAuth-based authentication flows. Kali365 PhaaS Platform Targets Microsoft […] The po…

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

FBI Warns of Kali365 Phishing Kit Targeting Microsoft 365 Users The FBI has issued a warning regarding the Kali365 phishing kit, which is actively stealing Microsoft OAuth tokens and bypassing multi-factor authentication (MFA) protocols. First identified in April 2026, Kali365 is marketed as a Phishing-as-a-Service (PhaaS) platform on Telegram, enabling less-technical attackers to execute phishing campaigns. The attack method involves sending emails that impersonate trusted cloud services, instructing victims to enter a device code on a legitimate Microsoft page, thereby granting attackers access to their accounts without needing credentials. This poses significant risks to organizations, including potential data theft and corporate espionage. The FBI has recommended creating conditional access policies and blocking authentication transfer policies to mitigate the threat. The rise of Kali365 adds to the growing concerns over phishing attacks, which 77% of organizations believe have increased in the past year. 135 sources 73

Extracted Entities

Microsoft 365 Users Targeted by New Phishing Threat that Bypasses MFA

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)

Tools (1)