MFA No Longer Foolproof? Kali365 Exploits Microsoft

A novel phishing-as-a-service platform, identified as Kali365, has emerged, posing a significant threat to Microsoft 365 users. First observed in April 2026, this service facilitates attacks that can bypass multifactor authentication (MFA) for popular applications like Outlook, Teams, and OneDrive. The FBI notes its proliferation primarily through Telegram, offering subscribers AI-generated phishing messages and tools to capture OAuth tokens.

The insidious nature of Kali365 lies in its exploitation of Microsoft's device code login process. Attackers trick victims into approving a sign-in initiated from their own device. This action unknowingly grants the attacker access tokens, effectively circumventing the need for passwords or subsequent MFA verification steps.

This vulnerability is particularly concerning for small businesses, where a compromised account can lead to highly believable internal communications, such as fake invoices or urgent requests. The attack chain typically begins with a phishing email, leading the victim to a seemingly legitimate Microsoft verification page where they input a deceptive device code.

Microsoft advises users to adhere to FBI recommendations and their own security best practices. Key protective measures include never entering a device code that wasn't personally requested, navigating directly to Microsoft's portal instead of using email links, and regularly reviewing account activity for suspicious sessions. Keeping MFA enabled is crucial, alongside vigilant scrutiny of any approval prompts or device codes.