FBI warns Microsoft 365 users of dangerous Kali365 phishing scam: How it works and how to stay safe
If you use Microsoft 365 for work including apps like Outlook, Teams or OneDrive, the FBI wants you to be aware of a new and fast moving phishing scam. On May 21, the agency issued a Public Service Announcement warning the public about an emerging threat called the “Kali365 Phishing Kit,” which it first detected in April 2026, according to the FBI’s Internet Crime Complaint Center.
And what makes this scam particularly dangerous is that hackers do not need your password to break in.
What is Kali365 and how does it work?
Kali365 is a subscription-based cybercrime platform that allows attackers to run automated phishing campaigns targeting Microsoft 365 accounts. The FBI described it as an emerging “Phishing-as-a-Service” (PhaaS) platform, which means that even hackers with limited technical skills can access advanced tools through it. According to The Hill, the platform is available to scammers for a monthly fee of $250 and is reportedly being distributed through Telegram.
“Kali365 lowers the barrier of entry, providing less-technical attackers access to AI-generated phishing lures, automated campaign templates, real-time targeted individual/entity tracking dashboards, and OAuth token capture capabilities,” the FBI said in its Public Service Announcement.
Also Read: Who are Abraham Hermosillo Alvaraz, Daniel Eskridge? What to know about the suspects in the alleged UFC Freedom 250 plot
Here is how the scam typically plays out, per the FBI:
Step 1- You receive a phishing email pretending to be from a trusted document-sharing or cloud productivity service. The email includes a device code and instructions asking you to visit a real Microsoft verification page to enter it.
Step 2- You go to the genuine Microsoft page and enter the code, without realizing you are actually authorizing the attacker’s device to access your account.
Step 3- Once you enter the code, the attacker captures OAuth access and refresh tokens, giving them control over your Microsoft 365 account, per the FBI’s PSA.
Step 4- The attacker can now freely access your Outlook, Teams and OneDrive without ever needing your password or going through any additional multifactor authentication checks.
Also Read: Nancy Guthrie update: Fresh clue raises chilling question – what if she’s never found? Expert weighs in
What is Phishing and how is it different from Smishing?
Scams sent via email fall under the category of phishing. Attackers impersonate a trusted person or service to steal sensitive information such as passwords, account numbers or Social Security numbers, according to the Federal Trade Commission.
Phishing emails typically include a general greeting, claim your account needs urgent attention, or contain a link or attachment for you to click. They often have spelling or grammar errors and may be marked as “external” or unverified.
Smishing is similar but arrives via text message on your mobile device instead of email. Like phishing, smishing tries to trick users into giving up sensitive information or taking actions that put their security at risk, according to CyberReady, as per Detroit Free Press.
Also Read: Pat Sajak life update: What the retired Wheel of Fortune host revealed after months of silence
What should you do if you are targeted?
Microsoft has advised users to follow the FBI’s guidance. A Microsoft spokesperson told The Hill: “More broadly, Microsoft actively works to disrupt cybercriminal ecosystems behind phishing-as-a-service and account takeover activity to protect our customers.”
The company’s Digital Crimes Unit has previously disrupted similar tools, including RaccoonO365 and other phishing scams, per The Hill.
The FBI urges anyone affected to file a complaint with the Internet Crime Complaint Center at ic3.gov, including details such as the phishing email, suspicious login attempts with time, IP address and location and any unauthorized devices or active sessions on the account.
The agency also advised users not to open links with access codes they did not request and recommended that organizations limit or block device authentication codes wherever possible to reduce the risk of such attacks.