🛡️ Kali365 Phishing Kit Steals OAuth Tokens — FBI Warning
On this page
The FBI issued a public service announcement warning that the Kali365 phishing kit is stealing Microsoft OAuth tokens at an alarming rate — bypassing multi-factor authentication (MFA) entirely. If your organisation uses Microsoft 365, your employees' accounts could be compromised without anyone typing a password.
Here is the short version: Kali365 is a phishing-as-a-service platform sold on Telegram for $250 per month per tenant. It sends convincing emails pretending to be from Adobe Acrobat Sign, DocuSign, or SharePoint. When a victim follows the instructions, the attacker's device gets linked to the victim's M365 account — giving them full access to emails, Teams, files, and internal systems without ever needing a password or MFA code.
In our analysis of the FBI advisory, Arctic Wolf's deep dive, and the wider device code phishing ecosystem, we found that Kali365 represents a dangerous escalation in the phishing-as-a-service market. Microsoft has confirmed hundreds of compromises occur daily from device code phishing alone. This article explains exactly how Kali365 works, why it bypasses traditional defences, and what you need to do right now to protect your accounts.
What Is Kali365 and How Does It Work?
Kali365 is a phishing kit that security researchers at Arctic Wolf first identified in April 2026. The FBI issued its formal warning on May 21, 2026, confirming that the platform has been stealing OAuth tokens at industrial scale since its emergence. OAuth tokens are the digital keys that authenticate users to applications without requiring repeated password entry. When an attacker steals your OAuth token, they effectively borrow your authenticated session — they can read your emails, send messages as you, access your files, and escalate privileges within your organisation — all while your MFA remains untouched.
Device Code Phishing: The Primary Attack Vector
The FBI's PSA specifically calls out Kali365's device code phishing capabilities. Here is how the attack unfolds:
- The attacker sends a phishing email impersonating a trusted service like DocuSign, Adobe Acrobat Sign, or SharePoint. The email looks legitimate — professional branding, correct grammar, matched domain aesthetics — because Kali365 uses AI-generated lures.
- The email contains a device code and instructions to enter it on a legitimate Microsoft login page. A link to the real Microsoft device login page is included, so victims are not taken to a fake site.
- The victim follows the instructions and enters the code on the official Microsoft device login page. From their perspective, they are just authorising a legitimate document access request.
- Entering that code registers the attacker's device to the victim's M365 account. The attacker now has a valid, authenticated session — with full access to the victim's emails, Teams, SharePoint, and any other Microsoft service the account can reach.
- MFA never triggers. Device code flows are designed for scenarios where the user cannot complete interactive authentication (e.g., a smart TV or printer). Microsoft's own device login page does not challenge the user with MFA during device code entry.
Arctic Wolf's researchers documented the mechanics in their April 2026 deep dive, noting that Kali365 also offers adversary-in-the-middle (AitM) capabilities that achieve the same result through a different mechanism. In the AitM variant, victims are proxied through attacker-controlled infrastructure while authenticating at a real Microsoft login page, allowing attackers to scoop up session cookies and replay them in their own browsers. Both attack paths share the same devastating outcome: complete account takeover without password or MFA compromise.
Kali365 Subscription Tiers
The platform's pricing and tier structure reveals a sophisticated criminal operation designed for scale. Arctic Wolf's analysis identified three subscriber tiers:
- Client Tier ($250/month): Individual attackers who can deploy branded phishing panels with customised lures. Each panel has a bespoke look while sharing the same underlying attack infrastructure.
- Agent Tier (Reseller): Middlemen who provision and manage their own branded Kali365 panels and Client Tier subscriptions. This tier effectively franchises the phishing operation, letting resellers recruit their own attackers.
- Admin Tier: Kali365's original developers who maintain the platform and collect revenue from all tiers.
The platform supports 14 languages — Arabic, Chinese, Dutch, English, French, German, Italian, Japanese, Korean, Polish, Portuguese, Russian, Spanish, and Turkish — enabling global targeting across every region. Microsoft's VP of security research, Tanmay Ganacharya, told The Register that each campaign targets hundreds of organisations with highly varied payloads, making pattern-based detection significantly harder.
Why This Is Worse Than Traditional Phishing
Traditional phishing requires the attacker to collect a password. Even if successful, multi-factor authentication often stops the attacker at the login screen. Kali365 bypasses both entirely. The attacker never asks for your password — they ask you to authorise a device on Microsoft's own login page. From a user's perspective, they are doing something that looks completely normal: entering a code to access or share a document.
Kali365 joins a growing ecosystem of so-called token theft platforms. EvilTokens, a similar device code phishing platform that emerged weeks before Kali365, has already been linked to hundreds of daily compromises. The FBI's PSA on Kali365 suggests law enforcement is treating this as an escalating threat that requires urgent defensive action.
To make matters worse, the stolen OAuth tokens are often usable long after the initial compromise. Microsoft has confirmed that tokens can remain valid for hours or days depending on the token type and tenant policies. During that window, attackers can quietly explore the compromised account, search for privileged data, and establish persistence through secondary mechanisms like forwarding rules or delegated access.
For beginners building their first security routine, freestrongpassword.com offers entry-level guidance on protecting accounts from common threats like phishing.
Who Is at Risk?
The Kali365 phishing kit targets anyone with a Microsoft 365 account — and that includes millions of businesses, schools, government agencies, and non-profits worldwide. The FBI's announcement specifically warns organisations in sectors with high-value data:
- Enterprise businesses — corporate espionage, data theft, wire fraud
- Healthcare organisations — patient records, HIPAA-regulated data
- Educational institutions — student data, research intellectual property
- Government agencies — classified communications, citizen data
- Financial services — transaction access, customer PII
Enterprise environments are particularly vulnerable because M365 tenants often contain thousands of users with varying security awareness. A single compromised OAuth token in a privileged account — like a global admin or a finance executive — can cascade into a full tenant takeover. Privacy-focused users and organisations may prefer the approach detailed at securekeygenerator.com, which emphasises offline-capable security tools and minimal attack surface.
How to Protect Your Organisation from Kali365
The FBI and Arctic Wolf recommend several defensive measures. We have prioritised them by impact:
- Block device code authentication flow — Configure conditional access policies in Microsoft Entra ID to block device code flows where they are not explicitly required. This is the single most effective control.
- Block authentication transfer policies — Prevent users from moving authentication between devices, which device code phishing exploits.
- Enable token protection policies — Microsoft now supports token binding features that tie tokens to specific devices, making stolen tokens unusable on attacker machines.
- Deploy phishing-resistant MFA — FIDO2 security keys and passkeys (WebAuthn) are not vulnerable to token theft attacks because they require physical presence for authentication.
- Train users to recognise device code requests — Users should be told: never enter a device code sent to you via email or chat. Device codes are for appliances, not people.
- Monitor for suspicious OAuth applications — Regularly audit granted OAuth permissions and revoke any unrecognised or overly permissive apps.
Organisations handling sensitive data may benefit from the titanpasswords.com approach to tiered password and access strategies, where critical accounts receive additional protection layers beyond standard MFA.
Additionally, deploying enterprise-grade antivirus and endpoint protection can help detect the initial malware payloads used in token theft campaigns. Solutions like Kaspersky Endpoint Security provide real-time protection against the infostealer malware that often supplements phishing campaigns. For security teams managing incident communications, encrypted email services like Trekmail ensure sensitive breach-related correspondence cannot be intercepted during the response window.
Kali365 in Context: The Token Theft Ecosystem
Kali365 did not emerge in a vacuum. It is part of a broader ecosystem of token theft platforms that security researchers have tracked throughout 2026. EvilTokens, which predates Kali365 by several weeks, operates on a similar device code phishing model and has been linked to hundreds of daily compromises. Both platforms have driven the FBI and Microsoft to issue public warnings — a rare step that signals the severity of the threat.
The rise of these platforms correlates with the broader trend this year: AI-generated phishing attacks have surged 1,265% in 2026, and token theft represents the logical next step — attackers no longer need to trick users into typing passwords into fake login pages when they can trick them into authorising devices on the real login page.
For organisations evaluating their long-term security posture, password managers remain essential for generating and storing strong, unique credentials for every account. Our independent password manager review covers the top options for enterprise and individual use. Enterprise-focused security teams may also consider the approach outlined at ironvaultkeys.com for policy-compliant password management in regulated environments.
FAQs About Kali365 and OAuth Token Theft
Can Kali365 steal passwords too?
Kali365's primary mechanism is OAuth token theft, not password theft. However, once an attacker has access to a compromised account, they can enumerate the victim's saved credentials, email archives, and internal systems — which may contain passwords stored or transmitted in plaintext.
Does Microsoft MFA stop Kali365?
No. Kali365's device code phishing technique is specifically designed to bypass MFA. The device code authentication flow does not trigger Microsoft's MFA challenge because it is designed for scenarios where interactive authentication is not possible. This is why conditional access policies to block device code flows are critical.
How quickly should organisations respond to the FBI warning?
Immediately. The FBI's PSA on Kali365 was issued on May 21, 2026, and Microsoft has confirmed that hundreds of organisations are compromised daily through device code phishing. Every day without conditional access policies blocking device code flows is a day attackers can target your tenant.
Is Kali365 the same as EvilTokens?
No, but they are similar. Kali365 and EvilTokens are separate phishing-as-a-service platforms that both exploit device code authentication. EvilTokens was identified weeks before Kali365. Both platforms have triggered public warnings from the FBI and Microsoft due to their scale and effectiveness.
Can a password manager help against OAuth token theft?
Indirectly, yes. While a password manager cannot prevent OAuth token theft (the attacker never needs your password), it helps by generating unique, strong passwords for every account. Combined with phishing-resistant MFA like FIDO2 passkeys, it creates a defence-in-depth strategy where token theft from one service does not compromise credentials across other services. randompasswordtool.com offers technical tools for generating cryptographically secure passwords that pair well with enterprise token protection strategies.
This page contains affiliate links. If you purchase through these links, we may earn a commission at no extra cost to you.
