FBI warns Microsoft 365 users about Kali365 phishing targeting Teams, Outlook and OneDrive

Federal law enforcement has issued a public cybersecurity warning to Microsoft 365 users after identifying what it described as a fast-acting phishing and account-compromise technique associated with the Kali365 hacking platform. According to the warning, the activity targets Microsoft services including Teams, Outlook and OneDrive, and is designed to take advantage of an authentication workflow that can be abused using OAuth device codes.

The FBI said the scammers specifically pursue OAuth device codes, which can be used in authentication flows to bypass multi-factor authentication prompts that are tied to the code’s use. The agency’s description, as reported by The Hill, emphasizes that the method can allow access without requiring the victim’s password, which changes the way users and system administrators might detect and contain the intrusion.

The warning highlights the difference between a conventional password-stealing attack and an approach that focuses on authentication tokens and device-code approvals. In practical terms, the FBI’s concern is that if a device code is successfully obtained and approved during the short window in which the code remains usable, an attacker may be able to sign in as the victim and then access associated email, files and communications hosted in Microsoft 365.

For organizations, the FBI warning points toward an operational problem: account takeover attempts may not look like typical “password required” logins. Administrators may need to review security monitoring to look for unusual sign-in patterns, failed and repeated authorization attempts, and other indicators of OAuth device-code misuse in addition to standard credential-theft indicates.

The report also places the activity in the broader context of criminal toolkits that automate targeting and speed up exploitation. Kali365, as described in the public warning, is presented as a platform capable of rapidly executing the account-access steps it seeks, increasing the likelihood that victims and defenders will have limited time to intervene after any fraudulent authorization attempts begin.

The next step for Microsoft 365 users and companies is to follow whatever mitigation steps the FBI included in its advisory, which The Hill says are aimed at reducing the risk of device-code-based account access. Because the details of the FBI’s recommendations are not reproduced in the report summary alone, specific instructions should be confirmed directly against the FBI warning once located.

The warning was released to the general public, underscoring that the affected systems are widely used by individuals and government and private organizations. The federal action does not, by itself, change laws or regulations, but it can influence agency and industry guidance on how to secure authentication systems that support OAuth-based sign-in.

The FBI’s advisory also raises enforcement and compliance questions for security teams that manage Microsoft 365 deployments, including how quickly suspicious authorization activity is logged and how incident response procedures account for account access that does not depend on password compromise. Teams that rely on Microsoft’s built-in security reporting and additional monitoring tools may need to confirm that their detection rules cover this specific authentication mechanism.