Leadership 1 publisher2 min readPublished September 13, 2026 at 7:06 PM PDT

Blocking Kali365 means deciding which business processes still need device code flow

The FBI says a subscription kit sold on Telegram harvests Microsoft 365 OAuth tokens through device code lures. The mitigation it recommends is a tenant-wide block, and somebody has to decide the exceptions.

The Board Room · Leadership desk

What happened

The FBI has issued a public service announcement about Kali365, a phishing-as-a-service platform first seen in April 2026 that lets subscribers take Microsoft 365 access tokens.
The lure is an email impersonating cloud productivity and document-sharing services, carrying a device code and instructions to enter it on a legitimate Microsoft verification page.
The subscription bundles AI-generated phishing lures, automated campaign templates, real-time target tracking dashboards and OAuth token capture, which the FBI says lowers the barrier of entry.
The bureau's first recommended protection is a conditional access policy blocking device code flow for all users, with limited exceptions for required business processes.

Compiled by The Board RoomSomething wrong?How this is made

Why it matters

decision The exception list moves a risk decision above the security team: whoever approves it is choosing which processes keep an authentication path the FBI has now flagged.
constraint Awareness programmes built on spotting a fraudulent domain have nothing to flag here, because the code is entered on Microsoft's own verification page.
exposure The remediation itself creates a failure mode: a block written without carve-outs can lock out the emergency access accounts kept for when other authentication fails.
capability Token capture and campaign dashboards are now available to buyers who could not build them, so the number of campaigns depends on how many people subscribe.

Writing the exception list is a management decision. Somebody has to say which business processes are allowed to keep using an authentication flow the bureau has just described as the way in, and the FBI tells defenders to look before they write: audit existing device code flow usage to identify legitimate dependencies first ^[12].

Order of operations matters because the control can fail in two directions. Block too broadly, too early, and you take out whatever legitimate process depended on the flow. The FBI puts the same caution in as a carve-out: if you cannot completely restrict device code flow usage, exclude emergency access accounts to prevent lockouts ^[14]. It also recommends blocking authentication transfer policies, which stop users moving an authentication session from a computer to a mobile device ^[13].

In the sequence the FBI describes, the target's own action is the correct one: go to the real Microsoft verification page and enter the device code, unknowingly authorizing the attacker's device ^[7]. None of the four protections in the announcement asks anything of that person ^[17]. Each is a change to tenant configuration, and for user-facing advice the PSA points to CISA's Phishing Guidance: Stopping the Attack Cycle at Phase One ^[16].

The bureau's framing is that Kali365 obtains Microsoft 365 access tokens and bypasses MFA without intercepting the user's credentials ^[3], and that once access and refresh tokens are captured ^[8], the attacker keeps reaching Outlook, Teams and OneDrive without a password or any additional MFA challenge ^[9]. The second factor is not broken in that account of it. The user completes it, and the tokens that result go to a device the user never saw. "Restricting device code flow to limit or block device authentication codes can help prevent or limit this style of attack," the FBI wrote ^[10].

Kali365 is distributed primarily through Telegram ^[2], and it is the subscription that supplies persistent access to a target's Microsoft 365 environment ^[4]. The announcement does not include a victim count or name the sectors targeted ^[18]. It asks anyone affected to file with IC3 and to include phishing email headers and bodies, suspicious logins with time, IP address and location, and any unauthorized devices or active sessions added to the account ^[15].

What to watch

Any IC3 follow-up that quantifies Kali365 losses or names the sectors being targeted.
Whether Microsoft changes the device code flow default so tenants do not have to block it themselves.
Whether other kits sold on Telegram add the same token capture against non-Microsoft identity providers.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
The FBI issued a public service announcement warning about an emerging Phishing-as-a-Service platform called Kali365, first seen in April 2026.
ReportedSupportedSource: FBI Internet Crime Complaint Center public service announcementView cited source
[2]
Kali365 has primarily been distributed via Telegram.
ReportedSupportedView cited source
[3]
Kali365 enables cyber threat actors to obtain Microsoft 365 access tokens and bypass multi-factor authentication protocols without intercepting the user's credentials.
ReportedSupportedView cited source
[4]
Through the Kali365 platform subscription, threat actors can capture OAuth tokens and gain persistent access to targeted individuals' or entities' Microsoft 365 environments.
ReportedSupportedView cited source
[5]
Kali365 lowers the barrier of entry, providing less-technical attackers access to AI-generated phishing lures, automated campaign templates, real-time targeted individual/entity tracking dashboards, and OAuth token capture capabilities.
ReportedSupportedView cited source
[6]
In the lure step, an attacker sends a phishing email impersonating trusted cloud productivity and document-sharing services, containing a device code with instructions to visit a legitimate Microsoft verification page and enter the code.
ReportedSupportedView cited source
[7]
In the authorization step, the target navigates to the real Microsoft page and pastes in the device code, unknowingly authorizing the attacker's device to access their account.
ReportedSupportedView cited source
[8]
The attacker captures OAuth access and refresh tokens, granting access to the target's Microsoft 365 account.
ReportedSupportedView cited source
[9]
The attacker can then access Microsoft 365 services such as Outlook, Teams, and OneDrive without needing a password or completing any additional MFA challenges.
ReportedSupportedView cited source
[10]
"Restricting device code flow to limit or block device authentication codes can help prevent or limit this style of attack."
ReportedSupportedSource: FBI public service announcement on Kali365View cited source
[11]
The FBI recommends creating a conditional access policy to block device code flow for all users, with limited exceptions for required business processes.
ReportedSupportedView cited source
[12]
The FBI recommends auditing existing device code flow usage to identify legitimate dependencies before creating a conditional access policy.
ReportedSupportedView cited source
[13]
The FBI recommends blocking authentication transfer policies to prevent users from transferring authentication from computers to mobile devices.
ReportedSupportedView cited source
[14]
The FBI advises that if device code flow usage cannot be completely restricted, emergency access accounts should be excluded to prevent lockouts.
ReportedSupportedView cited source
[15]
The FBI asks anyone impacted to file a complaint with the Internet Crime Complaint Center and to include phishing emails (header, body), suspicious logins (time, IP address, location), and any unauthorized devices or active sessions added to the account.
ReportedSupportedView cited source
[16]
The announcement directs readers to CISA's Phishing Guidance: Stopping the Attack Cycle at Phase One for best practices and mitigations against phishing techniques.
ReportedSupportedView cited source
[17]
All four protective measures the FBI lists change tenant authentication configuration or policy; none of them is a user awareness or training measure.
DerivedSupported1 source— sign in to open
[18]
The announcement does not state how many individuals or organizations have been affected by Kali365, and does not name targeted sectors.
DerivedSupported1 source— sign in to open
[19]
Because the authorization step takes place on Microsoft's genuine verification page, the fraudulent-domain signal that awareness training teaches users to spot is absent at the moment access is granted.
DerivedSupported1 source— sign in to open

Sources

Publishers with included, body-backed reporting in this cluster.

fbi.gov
1 article · September 13, 2026
Internet Crime Complaint Center (IC3) | Kali365 Phishing-as-a-Service Kit Hijacks Microsoft 365 Access Tokens

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

The notice is addressed to whoever administers the tenant, not to the people who wrote the clients that sign in through device code flow. That flow exists for command-line tools, headless services and devices with no browser or keyboard, and the FBI's advice is to block it for all users. Its second recommendation, to audit existing device code flow usage and find the legitimate dependencies before writing the policy, is the engineering half of the job. Our coverage found no indicators of compromise in the notice and nothing about revoking refresh tokens an attacker already holds, so an app owner gets the change but not the detection work.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence65

0100

Primary agency notice, details unverified

This is the FBI describing what it has seen, published under its own name through IC3, a single-source account carrying the Bureau's own authority. There are no indicators of compromise, no sample lure, no subscription price and no telemetry from Microsoft or an incident responder, so nobody outside the Bureau can check the April 2026 date or the feature list.

Adoption35

0100

Selling since April, scale unstated

The FBI puts Kali365 in active distribution on Telegram since April 2026 and describes paying subscribers, so this is a product in use rather than a demonstration. How widely is unknown: the notice reports no compromised account totals and no affected industries.

Hype gap

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

security
BigBear's phishing panel disables WebAuthn in the browser to beat MFA at 258 organizations
3 publishers
build
Three Russian clusters phish the grant, not the password, and MFA completion changes nothing
1 publisher
security
Scattered Spider talks help desks into moving MFA onto attacker-controlled devices
1 publisher
security
Vishing gets a product tier: Okta finds kits that steer the victim's browser mid-call
1 publisher

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Perspective Coverage

Reality

Related stories

Sources