FBI Warns of Kali365 AI-Powered Phishing Service Targeting Microsoft 365
The FBI issued a warning about Kali365, a phishing-as-a-service platform using AI-generated lures to steal Microsoft 365 OAuth tokens and gain unauthorized account access. The service bypasses multi-factor authentication by tricking users into authorizing attacker access through legitimate Microsoft device code verification pages.
What happened
The FBI identified Kali365 in April 2026, a phishing-as-a-service platform sold on Telegram that uses AI-generated lures to target Microsoft 365 accounts.
Kali365 tricks users into entering device codes on legitimate Microsoft authentication pages, which authorizes attacker access to victims' accounts without requiring password theft or interception of multi-factor authentication codes.
The service targets OAuth tokens, digital fragments that maintain session access to cloud services, and is designed to be accessible to attackers with minimal technical expertise.
Reported impact
Victims who fall for the scam grant attackers persistent access to Microsoft 365 services including Outlook, Teams, and OneDrive, bypassing multi-factor authentication protections.
The threat is particularly concerning for corporate users and organizations worldwide that rely heavily on Microsoft 365 for productivity and communication.
Index analysis
Kali365 exploits the OAuth authentication mechanism by impersonating productivity or cloud document-sharing services and directing users to legitimate Microsoft device code verification pages.
The platform lowers the barrier to entry by providing AI-generated phishing content, enabling less-technical actors to conduct sophisticated account takeover attacks.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.