Kali365 the PhaaS threat that steals tokens and puts MFA in check

The FBI has issued an alert on Kali365, a phishing-as-a-service (PhaaS) platform that facilitates attackers - even with little experience - to kidnap Microsoft 365 accounts by abusing the legitimate OAuth flow for devices. The central tactic, known as device code phishing, explores a mechanism designed for TV, printer or IoT devices to log in through another computer with little keyboard input; Kali365 automates and socializes this abuse to capture session tokens and avoid additional authentication measures. The FBI notification is available in public notice: FBI PSA on Kali365.

The legitimate flow is documented by Microsoft as the OAuth 2.0 grant for device authorization, designed for equipment with limited input: a short code is generated that the user introduces into microsoft.com / devicalauin and, after authentication, the device gets a token. The distortion of the attack is to start this process from the attacker's side and convince the victim, via phishing or social engineering, to enter the code into the Microsoft page; the result is that Microsoft emits a valid token that gives access without the attacker having entered the password or directly drawn the MFA. The technical explanation of the flow is available in Microsoft documentation: OAuth 2.0 Device Authorization (Microsoft).

What makes Kali365 especially dangerous is its commercial model: the platform offers automated templates, real-time tracking, IA-assisted generation of lures and ability to capture tokens and cookies (including an AitM mode called "Cookie Link"). This reduces the technical barrier to mass campaigns and diversifies the profile of actors who can run them. Researchers like Arctic Wolf have observed global campaigns that use precisely these techniques to access mailboxes, create malicious rules and record devices in Microsoft environments, which complicates detection and mediation: Arctic Wolf analysis of tokens capture.

The implications for organizations are clear: the existence of a valid token makes MFA an insufficient measure if the authorisation flow is manipulated. Attacks with access to tokens can move laterally through SSO applications - from Microsoft 365 to SaaS like Salesforce - and exfilter data or persist by creating records of devices or mail rules that hide activity. In addition, the proliferation of these services (EvilTokens, Tycoon2FA and others) indicates that vector is not an isolated incident but an increasing trend in 2026.

From a defensive perspective, the FBI recommends restricting or blocking device code authentication through conditional access policies and auditing its use in the tenant. In practice, this means reviewing all applications and flows that allow device code, applying application authorisation policies and blocking the transfer of sessions between devices if not required. In addition, it is recommended to force phishing-resistant authentication methods (e.g. FIDO2 keys) for privileged access contexts and to apply risk and session controls that mitigate the long validity of tokens.

In detection and response there are concrete operational steps: audit log-in and OAuth activities, monitor application and device authorization records, and review mailbox rules and email delegations after any suspicious access. Revocate refresh tokens and reset sessions of compromised users reduce abuse window; also, block IP or infrastructure associated with known campaigns and maintain forensic copies of phishing emails helps investigations. If your organization suffers an incident, you must report it to IC3 and keep evidence such as phishing emails, codes and records of unauthorized devices.

For end users the practical recommendation is simple but critical: never enter authentication codes requested by email, chat or calls that are not expected and always verify the origin of any communication that requests action on the portal of device login. Training in phishing detection should include specific exercises on this vector (e.g. simulations that teach to recognize device codes and AitM requests).

Finally, the cybercrime economy behind Kali365 - admins, resellers and affiliates structure - suggests that the solution is not only technical: it requires coordination between cloud suppliers, security teams, regulators and law enforcement to bring down infrastructure and close markets. Meanwhile, applying granulated access controls, strengthening MFA with phishing-resistant factors, auditing OAuth concessions and training users are measures that significantly reduce risk while authorities and industry try to contain these PhaaS.