The FBI has issued a public service announcement (PSA 260521, 21 May) warning about Kali365, a phishing-as-a-service platform first spotted in April and sold mainly through Telegram. It is still making mainstream news three weeks later, and for good reason: it represents the clearest sign yet that commodity phishing has moved past credential theft entirely.
Kali365 doesn’t steal passwords. It doesn’t need them.
How the attack works
The scam abuses something most people have used without knowing its name: device code flow. It’s the mechanism that lets you sign into a streaming app on a smart TV by typing a short code into a website on your phone, thereby having one device borrow an authenticated session from another.
The Kali365 chain goes like this. The victim receives a phishing email impersonating a trusted cloud productivity or document-sharing service. The email contains a code and instructions to visit a Microsoft verification page. The victim goes to that page; a genuine Microsoft domain, valid certificate, nothing for a password manager or a security-awareness course to object to and enters the code.
That’s it. By typing the code into a legitimate page, the victim has authorised the attacker’s application to access their Microsoft 365 account. The attacker captures the OAuth access and refresh tokens, and from there has persistent access to Outlook, Teams and OneDrive. No password intercepted. No MFA prompt defeated, because MFA was satisfied by the victim, on a real Microsoft page, for the attacker’s session.
Crime, subscription edition
What worries the FBI isn’t the technique, which has been circulating since at least early 2025. It’s the packaging. Kali365 is a turnkey subscription: AI-generated phishing lures, automated campaign templates, real-time dashboards for tracking targets, and built-in OAuth token capture. Arctic Wolf researchers put the price at $250 for 30 days or $2,000 for a year.
The platform also stores the tokens it harvests and makes them available to affiliates, meaning credentials-equivalent access to your mailbox can be reused by criminals who had nothing to do with the original phish. Arctic Wolf documented hundreds of Kali365 attacks in April alone, hitting manufacturing, education, insurance, finance, healthcare and government organisations across North America, Europe, the Middle East and Africa. Huntress has tracked a similar device-code campaign since February reaching more than 340 organisations across the US, Canada, Australia, New Zealand and Germany.
Phishing-as-a-service is not new, readers will remember our coverage of Operation Synergia III and the dent the Tycoon2FA takedown put in CAPTCHA-gated phishing earlier this year. Kali365 is the next iteration arriving on schedule: lower barrier to entry, AI doing the copywriting, and an attack flow specifically designed to route around everything the last decade of security training taught people to check.
Why this matters to the email industry specifically
Every standard signal fails here. The destination URL is genuinely Microsoft’s. TLS is valid. There is no spoofed domain for DMARC to catch, and in many campaigns the lure itself arrives from compromised or legitimately provisioned infrastructure that passes SPF and DKIM cleanly. We have spent years correctly telling senders to authenticate and telling users to check the link. Kali365 is engineered for a world where both checks pass and the attack succeeds anyway.
For anyone running email security, deliverability or abuse desks, the lesson is that “passes authentication” and “links to a legitimate domain” are no longer sufficient conditions for trust, and filtering strategies built on those signals will miss this entire class of attack. Behavioural signals: why is a document-sharing notification asking the recipient to type a code into a login page? .. This is where detection has to live.
What the FBI says to do about it
The advisory’s most concrete recommendation is also the most effective: use conditional access policies to block device code flow for all users who don’t genuinely need it. Most organisations don’t. Killing the flow kills the attack.
Beyond that: treat unexpected Microsoft authentication requests as hostile, especially when the user hasn’t initiated a sign-in; review OAuth application grants regularly and revoke anything unrecognised; and fold device-code lures into phishing simulations, because the current generation of training material doesn’t cover them.
One last point worth sitting with. The phishing emails themselves are reportedly polished; structured, enterprise-style templates with pre-emptive authenticity statements. The era of spotting the phish by its broken English ended a while ago. With AI writing the lures and Microsoft hosting the landing page, the only unreliable component left in the chain is the moment a human decides whether the request makes sense. Design your defences for that moment.
