Home / Technology / AI-Powered Phishing Service Targets Microsoft Accounts
AI-Powered Phishing Service Targets Microsoft Accounts
17 Jun
Summary
- Kali365 is a sophisticated phishing service targeting Microsoft accounts.
- It uses AI to analyze emails and craft convincing phishing lures.
- The FBI issued a warning about this advanced phishing toolkit.
A highly sophisticated phishing-as-a-service platform, identified as Kali365, has emerged as a significant threat, also operating under the names Octopi365 and Freedom365. This toolkit, first detected by security firm Huntress in May 2026, specifically targets Microsoft accounts.
The platform's advanced nature lies in its AI capabilities. It can analyze intercepted email threads, assess their fraud potential, and craft convincing reply messages, often impersonating trusted cloud services. The FBI has issued a public warning detailing its operations.
Kali365 does not bypass multi-factor authentication directly. Instead, it focuses on stealing session cookies and OAuth tokens through what appear to be legitimate Microsoft login pages. This allows attackers to gain authenticated access to a victim's account seamlessly.
The FBI's warning highlights the difficulty in avoiding such attacks due to their scale and sophisticated, legitimate appearance. Addressing this threat may require security changes from Microsoft to close authentication loopholes exploited by Kali365.
