SECURITYBLEEPING COMPUTER
FBI warns of Kali365 phishing service targeting Microsoft 365 accounts
The FBI has issued a warning about the Kali365 phishing-as-a-service platform, which exploits OAuth device code authentication to hijack Microsoft 365 accounts. The service steals session tokens and bypasses multi-factor authentication (MFA), posing a significant cybersecurity threat.
Mentioned
Related Signal
Adjacent reporting
- FBI warns of Kali365 phishing-as-a-service after April Microsoft 365 attacks
- FBI warns about fast-growing phishing kit targeting Microsoft 365 users
- Tycoon2FA hijacks Microsoft 365 accounts via device-code phishing
- The New Phishing Click: How OAuth Consent Bypasses MFA
- FBI warns Kali365 phishing kit is stealing Microsoft OAuth tokens at scale
- Tycoon 2FA Phishers Scatter, Adopt Device Code Phishing