🔑 Kali365 Phishing Bypasses MFA — FBI Issues Warning

The FBI has issued a warning about Kali365, a new phishing-as-a-service (PhaaS) platform that targets Microsoft 365 accounts and bypasses multi-factor authentication (MFA). First detected in April 2026 and distributed through Telegram channels, Kali365 gives even low-skilled attackers access to advanced phishing capabilities that were previously available only to sophisticated cybercrime groups.

What Is Kali365 and How Does It Work?

Kali365 is a PhaaS platform that abuses Microsoft's OAuth 2.0 Device Authorization grant flow — a legitimate authentication method designed for devices with limited input capabilities like smart TVs, conference room systems, streaming devices, printers, and IoT equipment. The flow works through a simple device code mechanism at microsoft.com/devicelogin.

Here is how the attack unfolds step by step:

1. The attacker initiates a device code request with Microsoft Entra ID, generating a short verification code
2. The victim receives a phishing email directing them to microsoft.com/devicelogin with this code
3. The victim enters the code and completes MFA — unaware they are actually authorising the attacker's device
4. Microsoft issues an OAuth access token directly to the attacker
5. The attacker gains full account access without ever needing the password or solving MFA challenges

What makes this technique particularly dangerous is that the victim willingly completes the MFA step themselves, believing they are logging into their own account. The entire attack exploits a legitimate authentication flow — not a software vulnerability — making it extremely difficult for traditional security tools to detect.

Kali365 Offers Two Attack Modes

Security researchers at Arctic Wolf, who reported on Kali365 activity in April 2026, identified two separate attack modes offered by the platform.

Device Code Phishing Mode

This mode follows the standard device code flow described above. The attacker generates a code, sends a phishing email with social engineering lures, and waits for victims to authorise access at Microsoft's login portal. The FBI confirms that Kali365 uses AI-generated phishing lures that are more convincing than traditional scam emails, making them harder for users to identify.

Cookie Link (AITM) Mode

The second mode, called "Cookie Link," uses an adversary-in-the-middle (AitM) approach. It proxies victims through attacker-controlled infrastructure that captures authenticated browser sessions, session cookies, and tokens after targets log in and complete MFA challenges.

This dual-mode approach means Kali365 operators have powerful tools to compromise Microsoft 365 environments regardless of how organisations configure their authentication flows.

Why This Matters: The Rise of Device Code Phishing in 2026

Device code phishing has seen widespread adoption in 2026, with multiple threat actors and platforms now using this technique. Besides Kali365, other platforms like EvilTokens PhaaS and Tycoon2FA are also leveraging device code phishing to compromise Microsoft 365 and Entra accounts.

According to security researchers, the technique is particularly effective because:

• It bypasses all forms of MFA — the victim completes the MFA challenge themselves
• It requires no password theft — the attacker never needs to capture or crack credentials
• It exploits legitimate authentication flows — security monitoring tools see authorised Microsoft traffic
• Post-compromise persistence — attackers register new devices and create malicious inbox rules

In some observed attacks, Kali365 operators created inbox rules designed to hide their activity from victims by automatically deleting or forwarding security alert emails. They also registered new devices in compromised Microsoft environments, extending their access deep into the breached network.

This technique has become prevalent enough that organisations of all sizes need to understand how it works and how to defend against it.

Who Is Behind Kali365?

Arctic Wolf's analysis revealed that Kali365 operates as a business with a structured hierarchy:

• Admins who manage product development and platform improvements
• Resellers who promote the service to other threat actors in underground forums
• Affiliates who conduct the actual phishing attacks against target organisations

The platform is distributed through Telegram channels, making it accessible to cybercriminals worldwide. The subscription-based model means that even attackers with limited technical skills can purchase and deploy sophisticated phishing campaigns targeting major organisations.

How to Protect Against Device Code Phishing

For Individuals

Never enter a device code you did not personally request. If an email, text message, or phone call asks you to visit microsoft.com/devicelogin and enter a code, this is almost certainly a phishing attack. Legitimate Microsoft services will never ask you to authorise a device code you did not initiate yourself.

Always verify the source of any message asking you to take authentication actions. Device code phishing emails often impersonate IT support teams, security departments, or software update notifications. When in doubt, contact your organisation's security team through a known communication channel — never through links or phone numbers provided in the suspicious message.

Use a password manager to store and autofill your credentials. Password managers help prevent phishing by only autofilling on websites whose URL matches your saved entry. NordPass is a strong choice — it stores all your passwords in a zero-knowledge encrypted vault, generates strong random credentials, and autofills them on legitimate sites while refusing to fill on phishing pages. If you need a reliable password generator, BestPasswordGenerator.org offers a free tool for creating strong, unique passwords. For secure encrypted communication, consider using Trekmail, an encrypted email service that protects your correspondence.

For Organisations

The FBI recommends the following measures to defend against Kali365 and similar device code phishing platforms:

1. Restrict or completely block device code authentication flows using Conditional Access policies in Microsoft Entra
2. Audit existing device code usage across your Microsoft 365 tenant to identify legitimate needs
3. Block authentication transfer policies that allow authentication sessions to move between devices
4. Enable detailed logging for device code authentication events and monitor for anomalies
5. Monitor for unusual inbox rule creation and new device registrations in compromised accounts
6. Train employees to recognise device code phishing as part of regular security awareness programmes

Strengthen Your Overall Security Posture

While defending against specific phishing techniques is important, building a comprehensive security foundation is essential. Use a strong, unique password for every account and enable MFA wherever possible. However, remember that MFA alone is no longer sufficient protection — attackers have adapted to bypass it.

Consider using phishing-resistant authentication methods like FIDO2 security keys or Windows Hello for Business, which cannot be bypassed through device code or AitM attacks. These methods use cryptographic proof of possession rather than shared secrets, making them immune to the type of attacks Kali365 employs. For an extra layer of protection when browsing on public Wi-Fi, Turbo VPN encrypts your internet connection and keeps your online activity private.

The FBI's Full Recommendations

The agency urges impacted organisations to take the following actions:

• Report incidents to the Internet Crime Complaint Center (IC3) at ic3.gov
• Preserve phishing emails, suspicious login information, and unauthorised device registrations as evidence
• Conduct a full account review for any affected users
• Revoke all OAuth tokens and refresh tokens for compromised accounts
• Implement time-based access policies that limit token validity windows

FAQs

What is Kali365?

Kali365 is a phishing-as-a-service platform that targets Microsoft 365 accounts by abusing OAuth device code authentication to steal session tokens and bypass MFA.

How does device code phishing work?

The attacker initiates a device authentication request with Microsoft, generates a code, and tricks the victim into entering it on Microsoft's login portal. The victim unknowingly authorises the attacker's access.

Can MFA protect against Kali365?

No. Kali365 specifically bypasses MFA because the victim completes the MFA challenge themselves while being tricked by the phishing attack.

What should I do if I entered a device code from a suspicious email?

Immediately contact your organisation's IT security team. Change your passwords, revoke any authorised devices, and review your account activity for unauthorised access.

How can organisations block device code authentication?

Use Conditional Access policies in Microsoft Entra to restrict or block device code authentication flows. Audit current usage and implement policies that prevent authentication transfer between devices.

Is device code phishing new?

The technique has been known since early 2024 but has seen widespread adoption in 2026. Multiple platforms including Kali365, EvilTokens, and Tycoon2FA now offer device code phishing capabilities.

What makes Kali365 different from other phishing platforms?

Kali365 offers AI-generated phishing lures, automated campaign templates, real-time victim-tracking dashboards, and both device code and AITM attack modes.

Conclusion

The rise of Kali365 and other device code phishing platforms marks a significant evolution in the phishing threat landscape. With MFA no longer providing complete protection, both individuals and organisations must adapt their security strategies. Stay informed, stay cautious, and never enter authentication codes that you did not personally request.