# FBI Warns of Kali365 Phishing-as-a-Service Platform Weaponizing Microsoft 365 OAuth Device Code Flow


The FBI has issued a warning about Kali365, a phishing-as-a-service (PhaaS) platform being weaponized to compromise Microsoft 365 accounts at scale. The service exploits OAuth device code authentication flows to hijack user sessions and bypass multi-factor authentication (MFA) protections—a sophisticated attack chain that enterprises may not be prepared to defend against.


## The Threat


Kali365 represents a new generation of phishing infrastructure: it's not a tool that individual threat actors cobble together, but a commercialized service offered to criminal operators with varying levels of technical sophistication. Threat actors using Kali365 launch targeted phishing campaigns that trick Microsoft 365 users into authorizing device code flows—a legitimate OAuth mechanism designed for devices with limited input capabilities, like smart TVs or command-line tools.


Key characteristics of the threat:


  • Attack Surface: Anyone using Microsoft 365 (Outlook, Teams, OneDrive, SharePoint, etc.) across any organization
  • Bypass Method: Leverages the OAuth device code flow to obtain valid session tokens without requiring the user's password
  • MFA Evasion: Session tokens obtained this way bypass traditional MFA challenges
  • Scalability: Offered as a service, enabling non-technical criminals to launch enterprise-grade attacks
  • Persistence: Compromised accounts remain under attacker control until tokens expire or accounts are forcibly signed out

    • The platform's commercialization is particularly concerning. Rather than requiring technical expertise, criminals can purchase access to Kali365 and use pre-built templates, phishing pages, and automated token harvesting mechanisms—dramatically lowering the barrier to entry for Account Takeover (ATO) campaigns.


    ## Background and Context


    OAuth device code flows were designed to solve a legitimate problem: how do users authenticate on devices that lack keyboards or web browsers? Rather than entering credentials on a smart TV, users visit a URL on a trusted device, enter a device code, and approve the login request. This mechanism exists across Microsoft, Google, and other major identity providers.


    The OAuth device code flow works as follows:


    1. Device requests a device code and user code from the authorization server

    2. Device displays the user code to the user

    3. User visits a URL on a trusted device and enters the user code

    4. User confirms they want to authorize the device

    5. Authorization server issues tokens to the original device


    This flow is legitimate and widely used. The problem arises when threat actors trick users into approving device codes they did not initiate. Kali365's phishing campaigns likely work by:


  • Sending users realistic-looking messages claiming to be from Microsoft
  • Directing them to a phishing portal that displays a device code
  • Instructing users to visit microsoft.com/devicelogin and enter that code
  • When the user approves the request (thinking it's routine), the attacker's device receives valid session tokens

    • From the user's perspective, the interaction appears to be a legitimate Microsoft authentication step. Many users may not realize they've authorized access by an attacker.


    ## Technical Details


    ### Why This Bypasses MFA


    The critical security flaw: device code flows do not trigger MFA prompts. When a user approves a device code on one device, the MFA validation happens on that same device—not on the attacker's device requesting the tokens.


    Consider the flow:


    1. Legitimate user is on their laptop (MFA-protected)

    2. Attacker sends phishing link claiming there's a security alert

    3. User visits the link, sees a Microsoft-branded page with a device code

    4. User goes to microsoft.com/devicelogin on their *same laptop*

    5. User enters the code (their laptop is already MFA-authenticated)

    6. Attacker's infrastructure receives valid session tokens without ever needing the password or triggering MFA


    The attacker now holds tokens for:

  • Outlook / Exchange (email access)
  • OneDrive / SharePoint (file access)
  • Teams (chat, call logs, metadata)
  • Other connected services depending on scopes granted

    • These tokens remain valid for hours or days, depending on configuration. The attacker can use them to:

  • Exfiltrate emails and files
  • Send emails impersonating the user
  • Access shared documents and sensitive projects
  • Move laterally to other systems that trust Microsoft 365 authentication
  • Plant malware or persistence mechanisms

    • ### Kali365 as Infrastructure


    Kali365 operators typically provide:


  • Pre-built phishing pages that mimic Microsoft login portals
  • Automated device code generation integrated with legitimate OAuth endpoints
  • Token harvesting and management dashboards
  • Campaign templates for common scenarios (security alert, account verification, admin action required)
  • Distribution infrastructure for phishing emails or SMS

    • The service operates on a subscription or pay-per-compromise model, making it economically viable for criminals targeting large organizations.


    ## Scope and Targets


    The FBI has observed Kali365 being used against organizations across multiple sectors, including:


  • Financial Services (banks, insurance, fintech)
  • Healthcare and Pharmaceuticals
  • Government Contractors and federal agencies
  • Technology companies
  • Education and research institutions
  • Critical Infrastructure operators

    • Attacks typically begin with reconnaissance—targeting specific employees in finance, IT, HR, or executive roles—before scaling to broader phishing campaigns against entire organizations.


    ## Implications for Organizations


    ### Immediate Risks


  • Email Compromise: Attackers can read all emails, draft messages as the user, forward sensitive documents, and reset recovery options
  • Data Exfiltration: Full access to OneDrive, SharePoint, Teams channels, and shared resources
  • Lateral Movement: Compromised accounts with elevated privileges can be used to attack other systems
  • Supply Chain Risk: Compromised supplier or partner accounts may be used to send malicious documents to your organization
  • Regulatory Breach: If sensitive data is exfiltrated, this triggers breach notification obligations (GDPR, HIPAA, state laws, etc.)

    • ### Detection Challenges


    Organizations relying solely on traditional MFA (password + SMS or authenticator app) may not detect these compromises immediately because:


  • MFA is not triggered during the device code approval
  • Email and file access logs appear normal
  • The attacker holds valid session tokens issued by Microsoft itself
  • Token use may not trigger anomalous behavior detection if the attacker is patient

    • ## Recommendations


    ### For Microsoft 365 Administrators


    Immediate actions:


    1. Disable device code authentication if not required for your organization:

    - In Azure AD, navigate to Authentication methods → Device Code

    - Set the policy to Disabled for users who don't need it

    - Consider conditional access rules to restrict device code flows to specific user groups or networks


    2. Implement device code restrictions via conditional access:

    - Allow device code flows only from corporate networks

    - Block device code flows from untrusted locations

    - Require device compliance checks before granting tokens


    3. Review recent OAuth authorization activity:

    - In Azure AD, check App registrations and Enterprise applications for suspicious new apps

    - Review user authorization history in Sign-ins and Risk detections

    - Look for multiple failed device code attempts followed by success


    4. Force sign-out of all active sessions:

    - If a breach is suspected, revoke all tokens for affected users

    - Require password reset on the next sign-in

    - Provide clear communication to users about what happened and what they should do


    ### For All Users and Organizations


  • Treat device code requests with suspicion: If you didn't initiate a request to approve a device, do not approve it—report it to IT immediately
  • Enable Conditional Access policies that require MFA for sensitive operations (sending rules, adding forwarding addresses, etc.)
  • Use Windows Hello or hardware security keys instead of password + SMS for MFA
  • Monitor for suspicious email forwarding rules and recovery email changes
  • Implement email authentication: SPF, DKIM, DMARC to prevent email spoofing in phishing campaigns
  • Train users on device code flows so they understand what they are approving

    • ### For Security Teams


  • Deploy User and Entity Behavior Analytics (UEBA) to flag anomalous account activity post-compromise
  • Monitor for token theft patterns: Multiple sign-ins from different geographies, unusual API calls, bulk file downloads
  • Conduct regular OAuth app audits to identify stale or suspicious applications
  • Use Azure AD risk detection to flag impossible travel, atypical token usage, and anomalous sign-ins

    • ---


    ## HackWire Analysis


    Kali365 represents a critical inflection point in identity-based attacks. For years, security discussions have centered on "assume breach"—but few organizations have truly planned for the scenario where an attacker holds valid, MFA-bypassing session tokens issued directly by Microsoft. This isn't a vulnerability in Microsoft 365 itself; it's a feature (device code flows) that criminals have operationalized into a scalable attack platform.


    The concerning pattern: just as phishing-as-a-service lowered barriers to entry for email compromise, Kali365 is doing the same for account takeover at scale. Unlike password spraying or brute force attacks, device code flows leave minimal forensic traces and blend seamlessly with legitimate authentication events.


    Organizations cannot simply patch their way out of this threat. Device code flows are part of OAuth 2.0's standard specification—they're not a bug. The defense is behavioral: organizations must assume that some users will fall for phishing, and they must implement compensating controls like conditional access, token hygiene, behavioral analysis, and user education.


    The timing is also significant: as regulators tighten breach notification laws and cyber insurance costs rise, the cost of a single compromised email account has climbed dramatically. For attackers, Kali365 represents an economically rational investment—one ATO can yield thousands of dollars in data exfiltration, ransomware leverage, or wire fraud. Expect this service to proliferate.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Policy](https://www.hackwire.news/category/policy) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)