A newly discovered phishing platform called Kali365 is being used to break into Microsoft 365 accounts in a way that sidesteps multi-factor authentication (MFA), the security feature that most organizations rely on as a frontline defense. Understanding how this attack works, and why it is so difficult to detect, is increasingly important for anyone responsible for cloud security.

What Is Kali365 and Where Did It Come From?

Kali365 is a Phishing-as-a-Service (PhaaS) platform, meaning it is a ready-made criminal toolkit that attackers can subscribe to and use without needing deep technical knowledge. It first appeared in April 2026 and is being sold and distributed through Telegram, the encrypted messaging app that has become a popular marketplace for cybercriminal services.

What makes Kali365 particularly notable is its business model. It operates much like a legitimate software subscription service, complete with monthly pricing, technical support, campaign dashboards, and step-by-step tutorials. This has dramatically lowered the barrier to entry for cybercrime, allowing even inexperienced attackers to run sophisticated phishing campaigns against enterprise cloud environments.

Why Traditional MFA Is No Longer Enough

To understand the threat, it helps to understand what Kali365 is actually after. Most cyberattacks target usernames and passwords. MFA was introduced as an additional barrier: even if a criminal steals your password, they still need a second form of verification (a text code, an app notification, a fingerprint) to get in.

Kali365 sidesteps this entirely. Instead of stealing passwords, it steals OAuth tokens, which are digital session keys that Microsoft issues to a user after they have already completed authentication, including MFA. Once an attacker has your token, they can access your account as if they were you, without ever knowing your password and without triggering MFA prompts. In many cases, they can maintain access even after the victim changes their password or resets their MFA settings, because the stolen token remains valid until it expires or is explicitly revoked.

How the Attack Actually Works

Kali365 exploits a legitimate Microsoft feature called device code authentication. This feature was originally designed for devices that cannot display a full browser, such as smart TVs, gaming consoles, and printers. The normal flow works like this: the device shows you a short code and asks you to visit a Microsoft web page on another device, enter the code, and complete sign-in. The device is then authenticated.

Attackers have found a way to abuse this flow. Here is what a typical Kali365 attack looks like in practice.

The victim receives a phishing email that looks like a routine Microsoft 365 notification. Common examples include a SharePoint file-sharing request, a Teams voicemail alert, an OneDrive document invitation, a password expiration warning, or an HR message. Many of these emails are highly personalized, using the victim’s name, company branding, and job-relevant language gathered from LinkedIn, company websites, or previously leaked data.

The email instructs the recipient to visit Microsoft’s legitimate device authentication page and enter a code that the attacker has already generated. Because the web page is genuinely hosted by Microsoft, the browser shows no security warnings, the TLS certificate is valid, and everything looks authentic. Standard phishing detection tools often miss this entirely because the victim is interacting with real Microsoft infrastructure, not a fake website.

Once the victim enters the code and completes the prompt, Microsoft hands a valid access token and a refresh token directly to the attacker’s device. The attacker now has full access to the victim’s Microsoft 365 environment.

What Attackers Do Once They Are Inside

After gaining access, attackers typically move quickly to establish a foothold that is hard to remove. Common post-compromise activities include reading and forwarding emails through hidden mailbox rules, using Teams and Outlook to send phishing messages to colleagues from the compromised account, downloading files from SharePoint and OneDrive, registering unauthorized applications within the Microsoft tenant to create persistent back-door access, and querying Microsoft’s Graph API to map out the organization’s users, groups, and resources.

Because all of this activity happens through a legitimately authenticated session, security monitoring tools often interpret it as normal user behavior. No malware is installed on the victim’s device, which means antivirus and endpoint detection software sees nothing wrong.

The Role of AI in Making These Attacks More Convincing

Kali365 also uses generative AI to write phishing emails. This matters because one of the easiest ways to spot a phishing email has always been poor grammar, awkward phrasing, or generic language. AI-generated emails have largely eliminated those clues.

The platform can produce fluent, contextually appropriate emails in multiple languages, tailored to the victim’s role, organization, and location. Some campaigns automatically adjust their messaging based on which approaches are generating the best results, effectively running ongoing optimization on the attack in real time.

A related platform called EvilTokens, also distributed through Telegram, offers similar capabilities alongside QR code phishing generators. QR code attacks (sometimes called “quishing”) are increasingly common because most email security filters are designed to scan text-based links rather than images, allowing the malicious destination to slip through undetected. The victim scans the code with their phone and is taken directly into a fraudulent authentication flow.

Why This Is Difficult to Detect and Stop

Several factors combine to make token-based phishing attacks unusually hard to defend against. The attack uses real Microsoft infrastructure, so there is no malicious domain to block. The emails are often convincing enough to fool security-aware employees. The session activity after compromise looks like normal cloud usage. And the stolen refresh token can keep regenerating new access tokens long after the initial attack, meaning the window for detection is often short but the window for damage can be long.

This also reflects a broader shift in how cybercriminals operate. Rather than planting malware on a device, modern attackers increasingly focus on compromising cloud identities and authenticated sessions, because that is where enterprise data actually lives.

What Organizations Can Do

Defending against this type of attack requires going beyond standard MFA. Key steps include disabling device code authentication flows for users who do not have a legitimate business need for them, implementing Conditional Access policies that restrict where and how Microsoft 365 can be accessed, deploying phishing-resistant authentication methods such as FIDO2 hardware security keys (which are significantly harder to abuse than app-based MFA), monitoring for unusual OAuth token issuance or unexpected Microsoft Graph API activity, and auditing third-party application permissions regularly to spot any unauthorized apps registered in the tenant.

Security awareness training also needs to be updated. Employees should know that a legitimate-looking Microsoft prompt asking them to enter a device code can be a sign of an attack, even when the page it points to is genuinely hosted by Microsoft.

The emergence of Kali365 is part of a broader transformation in the threat landscape. Cybercriminals are no longer primarily trying to install malware on individual computers. They are targeting the cloud identities, authenticated sessions, and trust relationships that hold enterprise software ecosystems together. As Microsoft 365 and similar platforms continue to expand across organizations of all sizes, the access token has effectively become the new password and the primary target for attackers seeking a way in.

References

  1. FBI Internet Crime Complaint Center (IC3) — Official Public Service Announcement on Kali365 (Alert I-052126-PSA, May 21, 2026) https://www.ic3.gov/PSA/2026/PSA260521
  2. Sekoia Threat Detection & Research — EvilTokens: New Widespread Device Code Phishing-as-a-Service (March/April 2026) https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/
  3. Microsoft Security Blog — Email Threat Landscape: Q1 2026 Trends and Insights (April 30, 2026) https://www.microsoft.com/en-us/security/blog/2026/04/30/email-threat-landscape-q1-2026-trends-and-insights/
  4. Microsoft Learn — Block Authentication Flows with Conditional Access Policy https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows
  5. Microsoft Learn — How to Enable Passkeys (FIDO2) in Microsoft Entra ID https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-passkey-fido2
  6. Cloud Security Alliance — OAuth Device Code Phishing Hits 340+ Microsoft 365 Organizations (March 25, 2026) https://labs.cloudsecurityalliance.org/research/csa-research-note-oauth-device-code-phishing-m365-20260325-c/
  7. Cloud Security Alliance — OAuth Device Code Phishing: 37x Surge in Enterprise Account Takeover (April 5, 2026) https://labs.cloudsecurityalliance.org/research/csa-research-note-oauth-device-code-phishing-surge-20260405/
  8. Help Net Security — EvilTokens Ramps Up Device Code Phishing Targeting Microsoft 365 Users (March 31, 2026) https://www.helpnetsecurity.com/2026/03/31/eviltokens-phishing-microsoft-365/
  9. The Hacker News — Device Code Phishing Hits 340+ Microsoft 365 Organizations Across Five Countries via OAuth Abuse (March 31, 2026) https://thehackernews.com/2026/03/device-code-phishing-hits-340-microsoft.html