FBI Warns of Kali365 Phishing-as-a-Service Platform Targeting Microsoft 365 at Scale

The FBI issued a public service announcement on May 21 about Kali365, a phishing-as-a-service platform first observed in April and distributed via Telegram, that captures Microsoft 365 OAuth tokens through device-code flows rather than stealing credentials 1. Victims are directed to a legitimate Microsoft verification page to enter an attacker-supplied code, unknowingly authorizing access; captured tokens then enable persistent entry to Outlook, Teams, and OneDrive without further MFA challenges 12. Arctic Wolf Labs, which obtained access to the Kali365 system, reported the platform charges $250 for 30 days or $2,000 annually and generates AI-driven lures impersonating Adobe, DocuSign, and SharePoint across dozens of languages 23. Arctic Wolf additionally found Kali365 supports adversary-in-the-middle (AitM) session capture alongside device code flows, and enables a full post-compromise workflow including mailbox access, contact harvesting, lateral phishing, and BEC keyword monitoring 23. Captured tokens are stored on the platform and made available to affiliates, allowing reuse by actors who played no part in the original phishing campaign 23.