Kali365 is a phishing-as-a-service platform that hijacks Microsoft 365 accounts by exploiting the OAuth 2.0 Device Authorization grant flow. Attackers initiate the device authorization process to generate a code, then trick victims into entering it on Microsoft's official device login portal. Once the victim completes MFA, Microsoft issues an OAuth access token that grants attackers full access to the victim's account and associated cloud services without further MFA challenges. Kali365 provides advanced phishing capabilities including AI-generated phishing lures, automated campaign templates, and token capture functionality. It also offers an adversary-in-the-middle mode called "Cookie Link" that captures authenticated browser sessions and tokens. The FBI advises organizations to restrict device code authentication flows and audit existing usage to prevent compromise.

Successful exploitation allows attackers to bypass MFA and gain full access to Microsoft 365 and other cloud SaaS accounts linked via single sign-on. This access enables data theft, mailbox manipulation through malicious inbox rules, and unauthorized device registrations within victim environments. The threat lowers the skill barrier for attackers by providing phishing-as-a-service capabilities, increasing the risk of widespread account compromises. The FBI notes that Kali365 has been observed targeting organizations globally.

The FBI recommends organizations restrict or block OAuth device code authentication flows using Conditional Access policies where feasible. Organizations should audit current device code usage and block authentication transfer policies that allow session movement between devices. Incident reporting to the Internet Crime Complaint Center is advised, along with preserving phishing emails, suspicious login data, and records of unauthorized device registrations. As this is an abuse of a legitimate authentication flow, these controls are critical to reducing exposure. Patch status is not applicable as this is an abuse of a legitimate feature rather than a software vulnerability.