Kali365 Malware Hijacks Microsoft 365 Tokens

Security researchers and federal agencies, including the FBI, report that the rise of Phishing-as-a-Service (PhaaS) platforms like Kali365 marks a shift from credential theft to session hijacking. By exploiting the OAuth 2.0 Device Code Flow, these platforms bypass Multi-Factor Authentication (MFA) entirely, allowing attackers to seize persistent access tokens for Microsoft 365 environments without ever needing a user’s password.

How Kali365 Bypasses Traditional MFA

The core of the Kali365 threat is not a technical vulnerability in the Microsoft 365 platform, but an exploitation of the legitimate Device Code Flow mechanism. According to FBI alerts, this feature was designed to simplify authentication for devices lacking browsers, such as smart TVs or command-line interfaces. Attackers leverage this by tricking users into authorizing a device they do not own.

The process follows a specific cycle: the attacker sends a lure email mimicking a cloud productivity tool, directing the victim to a legitimate microsoft.com URL. When the victim enters the provided device code, they are unknowingly granting the attacker’s device authorization to their account. Because the victim completes the MFA prompt as part of this process, the system treats the attacker’s session as fully authenticated.

The Role of AI in Scaling Phishing Operations

Kali365 differentiates itself from older phishing kits by integrating generative AI to craft highly tailored lures. Security reports indicate that these AI-driven emails adapt to the victim’s specific industry, company context, and internal communication style. This shift makes traditional pattern-based email filters significantly less effective, as the messages lack the generic “red flags” often associated with mass-market phishing.

The platform also provides real-time dashboards for attackers, offering tracking capabilities that notify them the moment a token is captured. This level of visibility allows adversaries to maintain persistence inside an organization’s network for weeks, often evading detection because they are using valid session tokens rather than attempting suspicious password resets.

Mitigating the Token-Based Attack Vector

To defend against session hijacking, the FBI and CISA recommend proactive configuration changes within the Microsoft Entra ID (formerly Azure AD) environment. The most effective defense is the implementation of Conditional Access Policies that explicitly restrict or block the Device Code Flow for standard user accounts.

• Audit Dependencies: Before blocking the flow, identify which legitimate business processes—such as automated scripts or CLI tools—rely on Device Code authentication.
• Restrict Authentication Transfer: Enable policies within Entra ID that prevent the movement of authentication sessions between devices.
• Protect Breakglass Accounts: Ensure your emergency access, or “breakglass,” accounts remain exempt from restrictive policies to prevent accidental lockouts during an incident.

Frequently Asked Questions

Does MFA protect against Kali365?

No. Kali365 bypasses MFA because the user unknowingly performs the MFA verification themselves during the Device Code Flow, granting the attacker a valid session token.

What is an OAuth token?

An OAuth token is a digital key that allows an application to access a user’s data—such as Outlook or OneDrive—without needing the user’s password. Whoever holds this token can act as the user.

Where should I report a suspected compromise?

The FBI advises victims to report incidents via the Internet Crime Complaint Center (IC3) at www.ic3.gov, providing all relevant login logs and email headers.