FBI warns Microsoft 365 users of Kali365 passwordless phishing scam

A new phishing‑as‑a‑service called Kali365 was highlighted in an FBI alert on May 21 2026, showing how attackers can bypass password and MFA by stealing OAuth tokens that grant persistent access to Microsoft 365 services such as Outlook, Teams and OneDrive【1】.

How the scam works

The FBI describes a four‑step flow: a phishing email mimics a trusted Microsoft service and includes a device code; the victim follows a link to a legitimate Microsoft verification page and enters the code; this authorizes the attacker’s device, handing over OAuth access and refresh tokens; the attacker then retains unlimited, password‑less access to the victim’s account【1】. Because the tokens bypass multi‑factor authentication, the compromise can continue indefinitely unless the user revokes the tokens.

Scope and implications

Microsoft 365 powers “hundreds of millions” of users and “millions of businesses worldwide,” including more than a million U.S. companies【1】. The FBI notes that Kali365 lowers the technical barrier, offering AI‑generated phishing lures and automated campaign tools for a subscription fee, enabling low‑skill actors to hijack email, cloud storage and collaboration tools【3】. The platform’s reliance on the device‑code flow means that disabling or restricting this authentication method can mitigate the risk, a recommendation the FBI includes in its advisory【1】.

What to watch

• Policy changes – Microsoft may tighten default settings for device‑code flow or issue tighter conditional‑access guidance.
• Subscription uptake – Monitoring the prevalence of Kali365 subscriptions on Telegram could signal the scale of the threat.
• Enterprise response – Large organizations’ security teams may roll out broader token‑revocation sweeps or adopt stricter MFA enforcement.

The emergence of Kali365 underscores a shift in credential‑theft tactics: rather than stealing passwords, attackers are targeting the underlying authentication tokens that keep users logged in. As the FBI’s alert shows, the effectiveness of this approach hinges on Microsoft’s ability to adapt its access‑control mechanisms and on users’ vigilance in monitoring token activity.