- BIST10011,722-2.89%
- USD49.45+0.05%
- EUR55.62+0.37%
- GOLD4,181.10+0.26%
- INTEREST37.00%-1.00
- BITCOIN81,275-0.28%
- October 17, 202613°
- BIST10011,722-2.89%
- USD49.45+0.05%
- EUR55.62+0.37%
- GOLD4,181.10+0.26%
- INTEREST37.00%-1.00
- BITCOIN81,275-0.28%
- October 17, 202613°
FBI warns Microsoft 365 users of passwordless phishing scam
The FBI has warned about a new phishing platform called Kali365 that targets Microsoft 365 accounts and can infiltrate accounts through device code approval without needing a password.
The United States Federal Bureau of Investigation (FBI) has issued a warning about a new phishing scam targeting Microsoft 365 users that can access accounts without entering a password. The phishing-as-a-service platform called Kali365 threatens Microsoft 365 applications, particularly Outlook, Teams, and OneDrive.
According to the FBI, the platform was first detected in April 2026 and spreads largely through Telegram. It offers attackers AI-generated phishing messages, automated campaign templates, monitoring dashboards, and tools to capture OAuth tokens.
Why can it bypass multi-factor authentication?
The scam abuses Microsoft's device code sign-in process. The attacker initiates a sign-in from their own device and tricks the victim into entering the code on a real Microsoft verification page. When the victim enters the code, they unknowingly authorize access to the attacker's device. At that point, the attacker can log into Outlook, Teams, and OneDrive without needing a password or new MFA confirmation.
It becomes difficult to tell that the email is fake because the redirected page carries the real Microsoft address, password managers do not give warnings, and the page looks secure.
Small businesses at greater risk
The FBI stresses that small businesses in particular need to be careful. Through a compromised account, attackers can examine email correspondence and send fake invoices, request file sharing, or relay password reset instructions. The attack is harder to detect because it appears to come from a familiar person.
How does the attack happen step by step?
- A phishing email that appears to come from a trusted productivity or file-sharing service is sent to the victim.
- The email contains a device code, and the victim is asked to enter it on the real Microsoft verification page.
- When the victim enters the code, they have authorized access to the attacker's device.
- The attacker captures OAuth access and refresh tokens.
- Access to Microsoft 365 services (Outlook, Teams, OneDrive) is gained without needing a password.
Red flags and Microsoft's statement
The FBI warns against unexpected requests to enter a Microsoft device code. Especially urgent messages (such as document expiring, account verification required) and sign-ins that you did not initiate should be considered red flags.
Microsoft stated that users should follow the FBI's recommendations and its own best practice guides. The company also said it is working to disrupt cybercrime ecosystems linked to phishing services and account takeover activities, recently intervening in operations such as Fake ONNX, RaccoonO365, and Tycoon 2FA.
FBI tips to protect your account
- Do not enter any device code that you did not personally initiate.
- Go directly to your Microsoft account instead of clicking links in surprising messages.
- Regularly check your account activity and end sessions you don't recognize.
- If you entered a suspicious code, immediately close all sessions, revoke app access, and change your password.
- Keep multi-factor authentication enabled; this scam does not render MFA completely useless, but it requires attention to approval prompts.
- If your business does not need device code flow, restrict it with a conditional access policy.
- In case of unauthorized access, report it to the FBI's Internet Crime Complaint Center (IC3.gov).
The FBI advises that users who have previously entered the code should act quickly: log out of all devices and change their password, check their recovery email and phone number, review Outlook forwarding rules and inbox rules, and be sure to notify their IT team.
Stay Updated with The Turkiye Times
Subscribe to be informed about special news, developments and announcements. We will keep you informed.
By signing up, you agree to our Privacy Policy
