The FBI has warned that a phishing service called Kali365 can bypass multi-factor authentication on Microsoft 365 accounts by stealing authentication tokens rather than passwords. The bureau issued guidance on the threat in a public service announcement today.
Kali365 is a phishing-as-a-service platform, distributed through Telegram, that the FBI says emerged in April. It packages phishing capability for less technical attackers, providing AI-generated phishing lures, automated campaign templates, real-time dashboards for tracking targeted individuals, and tools for capturing OAuth tokens. The use of AI-generated lures and ready-made templates is aimed at attackers with limited technical skill, widening the pool of people able to run convincing campaigns.
The attack relies on a technique known as device code phishing. A victim receives an email impersonating a cloud or document-sharing service and is instructed to visit a legitimate Microsoft verification page and enter a device code supplied by the attacker. Because the victim authenticates on Microsoft’s real sign-in page and completes any multi-factor prompt themselves, the login appears genuine. Once the victim finishes, the attacker captures the resulting OAuth access and refresh tokens.
Those tokens are what make the technique effective against MFA. With valid access and refresh tokens, the attacker can reach Microsoft 365 services such as Outlook, Teams, and OneDrive without a password and without triggering further multi-factor challenges, because the account has already cleared authentication. Refresh tokens can remain valid for an extended period, allowing persistent access until the tokens are revoked.
The approach matters for the identity-security field because it targets the session that authentication produces, rather than the credentials or biometrics used to log in. Multi-factor authentication, including phishing-resistant methods, is designed to protect the moment of sign-in. A token stolen after a legitimate sign-in sidesteps that protection, which is why token theft has become a recurring method for defeating MFA on cloud platforms.
The FBI’s public service announcement, available through its Internet Crime Complaint Center, sets out steps that users and organizations can take to reduce exposure to device code phishing. The bureau is encouraging organizations that use Microsoft 365 to review their configurations and monitor for the token-based activity associated with the technique.
Sources: Help Net Security, FBI Internet Crime Complaint Center
–
By the ID Tech Editorial Team
