The US Federal Bureau of Investigation (FBI) has issued a warning about a new phishing scam targeting Microsoft 365 users that can access accounts without entering a password. The phishing-as-a-service platform called Kali365 threatens Microsoft 365 applications, particularly Outlook, Teams and OneDrive.
According to the FBI, the platform was first detected in April 2026 and is spreading largely via Telegram. It offers attackers AI-generated phishing messages, automated campaign templates, tracking dashboards and tools to capture OAuth tokens.
How does it bypass multi-factor authentication?
The scam exploits Microsoft's device code login process. The attacker initiates a login from their own device and tricks the victim into entering the code on a genuine Microsoft verification page. When the victim enters the code, they unknowingly authorize access on the attacker's device. At that point, the attacker can log into Outlook, Teams and OneDrive without needing a password or a new MFA approval.
It is hard to tell the email is fake because the redirected page carries the real Microsoft address, password managers do not flag it, and the page looks legitimate.
Small businesses at greater risk
The FBI stressed that small businesses in particular need to be cautious. Using a compromised account, attackers can review email correspondence, send fake invoices, request file sharing or relay password reset instructions. Because the attack appears to come from a familiar person, it is hard to detect.
Step-by-step breakdown of the attack
- A phishing email that looks like it came from a trusted productivity or file-sharing service is sent to the victim.
- The email contains a device code and asks the victim to enter it on the genuine Microsoft verification page.
- When the victim enters the code, they authorize access on the attacker's device.
- The attacker captures OAuth access and refresh tokens.
- Access to Microsoft 365 services (Outlook, Teams, OneDrive) is gained without a password.
Red flags and Microsoft's statement
The FBI warns against unsolicited requests to enter a Microsoft device code. Especially urgent messages (such as document expiring or account verification needed) and login processes you did not start yourself should be considered warning signs.
Microsoft said users should follow the FBI's recommendations and its own best practice guidance. The company also stated it is working to disrupt cybercrime ecosystems linked to the phishing service and account takeover activities, and recently took action against operations such as Fake ONNX, RaccoonO365 and Tycoon 2FA.
FBI's recommendations to protect your account
- Do not enter any device code you did not personally initiate.
- Navigate directly to your Microsoft account instead of clicking links in suspicious messages.
- Regularly review your account activity and end sessions you do not recognize.
- If you entered a suspicious code, immediately sign out of all sessions, revoke app permissions and change your password.
- Keep multi-factor authentication enabled; this scam does not make MFA completely useless, but it requires careful attention to approval prompts.
- If your business does not need the device code flow, restrict it with a conditional access policy.
- In case of unauthorized access, report it to the FBI's Internet Crime Complaint Center (IC3.gov).
The FBI advises users who have already entered a code to act quickly: sign out from all devices, change passwords, check recovery email and phone number, review Outlook forwarding and inbox rules, and notify their IT team.
