microsoft-365-security

How Does Kali365 Bypass Microsoft 365 MFA?

A phishing platform called Kali365 is hijacking Microsoft 365 accounts by bypassing multi-factor authentication entirely. The FBI issued a warning in 2026, and the attacks are spreading via Telegram. Your MFA is not enough protection anymore.

Lucas Oriens Kim

02 6월 2026 • 7 min read

Quick Answer
Kali365, a criminal phishing platform, steals Microsoft 365 accounts by tricking users into approving fake login requests. It captures session tokens that make MFA useless. The FBI flagged it in April 2026. Thousands of criminals now subscribe to it on Telegram for a monthly fee.

The FBI Warning Nobody Talked About Enough

Kali365 emerged in April 2026 and spread across multiple Telegram channels within weeks

In April 2026, the FBI published a warning about Kali365, a phishing-as-a-service platform sold openly on Telegram to criminals with no technical background. It targets anyone with a Microsoft 365 account.

Kali365 operators were already hitting businesses, government contractors, and individual professionals. The trick: victims don't type their passwords. Instead, they get a message, a fake Microsoft login prompt, or a spoofed Teams notification asking them to approve a device login. One click. Session tokens captured instantly. The attacker walks into email, OneDrive, SharePoint, and everything connected to the account.

Real attacks already happened. Accounts compromised through Kali365 became vehicles for business email fraud, invoice redirection scams, and data theft. Solo freelancers got hit. Employees at mid-sized firms got hit. The constant: they all had MFA enabled and believed they were protected.

💡 Key Insight: MFA stops nothing when the attack bypasses it entirely.

How Kali365 Actually Breaks Into Your Account

OAuth device code phishing requires zero technical skill when using Kali365

The attack exploits OAuth device code authentication, a legitimate Microsoft feature designed for devices without keyboards. Smart TVs and printers use it to log into Microsoft services by generating a short code you enter on another device. Kali365 weaponizes this.

Step 1: You receive a message. Email, Teams chat, LinkedIn, text. It says 'Your Microsoft account needs verification' or 'You have a pending file share.' There's a link.

Step 2: You click and land on what looks exactly like a Microsoft login page. You're asked to enter a device code or approve a session. The page routes through real Microsoft infrastructure and real OAuth endpoints.

Step 3: You approve the request. Kali365 captures your session token, not your password. A session token proves you already authenticated. It tells Microsoft's servers you're logged in. MFA already completed. The attacker now owns your token.

Step 4: The attacker uses that token from their own machine. No password needed. No MFA prompt. They're inside.

💡 Key Insight: This attack never needs your password.

Why Smart People Are Falling for This

Session token hijacking attacks jumped 147% between 2023 and 2025 across cloud identity platforms

Standard phishing advice talks about spelling mistakes, suspicious sender addresses, bad logos. That's outdated for Kali365. The pages route through real Microsoft domains. The OAuth prompts are real Microsoft prompts. Visually, nothing is wrong.

The trap is consent. You've approved Microsoft requests dozens of times. New app, new browser, third-party integration. You clicked yes. Kali365 injects a fake request into that familiar flow. Your brain pattern-matches it to every legitimate time you hit approve.

Security researchers found something genuinely surprising: fake requests often arrived during work hours, sometimes appearing to come from a compromised colleague's email. Context felt completely normal. A Tuesday afternoon message from a coworker asking you to review a shared document doesn't trigger suspicion.

If you're confident you'd never fall for a phishing page, that's the exact confidence that works against you. The page you're approving isn't a phishing page. It's a real Microsoft prompt a criminal triggered.

💡 Key Insight: Looking harder won't stop this. Changing your behavior before you click will.

Your Defense Checklist: Do These Today

FIDO2 security keys blocked 100% of phishing-based account takeovers across Google's 85,000 employees

Enabling MFA isn't enough. These steps actually work.

1. Replace SMS or authenticator-app MFA with phishing-resistant MFA. Use FIDO2 security keys like a YubiKey (about $50) or Windows Hello. These cryptographically bind authentication to your physical device and can't be intercepted by token theft.

2. Go to your Microsoft 365 admin portal or personal account settings. Find 'App permissions' and revoke any OAuth app access you don't recognize. Kali365 attacks often leave authorized apps that maintain persistent access even after you change your password.

3. Turn on Conditional Access policies if your organization uses Microsoft Entra ID. Require compliant devices. An attacker with a stolen session token from a personal laptop gets blocked if your policy requires a managed corporate device.

4. Never approve a Microsoft login request you didn't personally initiate in the last 30 seconds. An approval prompt appearing unprompted? Deny it and report it.

5. Tell your team and family about device code phishing. Not generic phishing. This one. When you see 'enter this code to verify your device,' that's a red flag.

If SMS is still your only second factor, swap it this week.

💡 Key Insight: One $50 hardware key eliminates the entire attack surface Kali365 exploits.

Key Takeaways

🎯Kali365 has been actively distributed on Telegram since April 2026, meaning it is already in the hands of thousands of low-skill criminals targeting everyday Microsoft 365 users.

📌Session token hijacking renders MFA useless because the attacker never needs your password or a one-time code. They steal proof that you already authenticated.

⚡The attack routes through real Microsoft OAuth infrastructure, so no phishing detector, no antivirus, and no careful eye will catch it. You cannot see it coming visually.

🔑Switching to a FIDO2 hardware key or Windows Hello today is the single action that completely blocks this attack vector. Authenticator apps do not.

💎As PhaaS platforms like Kali365 make sophisticated token-theft attacks available for monthly subscriptions, expect account takeover attempts to triple against cloud-based work accounts by end of 2026.

FAQ

Q: How do I know if a Microsoft login approval prompt is fake?
A: If you did not initiate a login within the last 30 seconds, any approval request is suspicious and should be denied immediately. Legitimate Microsoft authentication prompts are only triggered by actions you just took, not by incoming messages or emails asking you to approve something.

Q: Does changing my Microsoft password stop an attacker who already used Kali365?
A: No, and this is the part most people miss. Once a session token is captured and used, the attacker has an active authenticated session that a password change does not automatically terminate. You need to go to your Microsoft account security settings and select 'Sign out of all sessions' immediately, then revoke all connected OAuth app permissions.

Q: What should I do right now if I think I was targeted?
A: Go to account.microsoft.com, navigate to Security, and click 'Sign out everywhere' to invalidate all active sessions. Then check 'App permissions' and remove any apps you do not recognize, and file a report at ic3.gov so the FBI can track the campaign.

Conclusion

Kali365 is operational now. It's cheap. It specifically targets the MFA protection you thought was working. Log into your Microsoft account today. Go to Security settings. Swap your authenticator app for a FIDO2 key or Windows Hello if your device supports it. Do this first. Everything else comes after.

How Do AI Phishing Tools Actually Stop Attacks?
AI-generated phishing emails now pass every grammar check, mimic your boss's writing style, and arrive personalized with your real job title. Spam filters built before 2022 miss most of them. A specific stack of behavioral AI tools can catch what legacy security cannot.
How Does AI Help Cybersecurity Teams — And How Do Attackers Abuse the Same Tools?
The same AI tools that help security teams detect threats in milliseconds are being weaponized to clone voices, generate perfect phishing emails, and impersonate executives on live video calls. This isn't a future risk — it already cost one company $25 million in a single afternoon. Here's exactly w
How Did 35,000 Users Get Hit by Phishing?
Between April 14–16, 2026, attackers posing as HR departments stole authentication tokens from 35,000 people across 26 countries — without ever needing their passwords. Standard two-factor authentication didn't stop it. Here's what actually will.