FBI Issues Warning on Kali365 Phishing Scam Targeting Microsoft 365 Users

The Federal Bureau of Investigations has issued a warning about a phishing scam that targets Microsoft 365 users. This scam, known as Kali365, is a Phishing-as-a-Service platform that has been mainly distributed on Telegram.

Kali365 enables hackers to bypass multi-factor authentication without the need for a user's log-in credentials. Cyberattackers send phishing emails purporting to be a reputable cloud or document-sharing service, containing codes and instructions for visiting a real Microsoft verification page.

When the victim inputs the device code, they are unwittingly authorizing the cyberattacker's device to access their account. Once a cyberattacker has successfully pulled off the phishing scam, they have access to the victim's Microsoft services, including Outlook email, Teams, and OneDrive cloud service.

The FBI first detected the Kali365 phishing scam in April and has offered tips for protecting against the scam. It urges anyone who receives a suspicious email or notices suspicious logins from unauthorized devices to report them to the Internet Crime Complaint Center.

The FBI warns against opening links with access codes that have not been requested. Kali365 lowers the barrier of entry, providing less-technical attackers access to AI-generated phishing lures, automated campaign templates, real-time targeted individual/entity tracking dashboards, and OAuth token capture capabilities.