# Kali365 PhaaS — Telegram-Distributed Microsoft 365 Device-Code Phishing with OAuth Token Theft & MFA Bypass (FBI PSA I-052126-PSA)

> Kali365 is a Phishing-as-a-Service (PhaaS) platform, first observed in April 2026 and warned about by FBI PSA I-052126-PSA on 2026-05-21, that abuses Microsoft's legitimate OAuth 2.0 device authorization grant flow (RFC 8628) to steal access and refresh tokens against Microsoft 365 tenants, bypassing MFA without ever collecting passwords. The service is sold and operated through Telegram channels and provides AI-generated lure templates, automated campaign deployment, real-time victim dashboards, and post-consent OAuth token capture that yields persistent access to Outlook, Teams, OneDrive and SharePoint.

- **Published:** 2026-05-22T12:00:00Z
- **Last reviewed:** 2026-05-22T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0560
- **ID:** TL-2026-0560
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** Kali365 PhaaS operators
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Kali365 is a turnkey Phishing-as-a-Service (PhaaS) offering that surfaced in underground Telegram channels around April 2026 and was elevated to a FBI Public Service Announcement (I-052126-PSA) on 2026-05-21 after observed exploitation against U.S. enterprise Microsoft 365 tenants in healthcare, financial services, legal, and managed-services sectors. Unlike traditional adversary-in-the-middle (AiTM) kits such as Tycoon2FA or EvilProxy, Kali365 does not proxy victim credentials; instead it exploits the legitimate Microsoft identity platform device authorization grant (https://login.microsoftonline.com/{tenant}/oauth2/v2.0/devicecode), turning a sanctioned protocol into a no-credential-theft phishing primitive.

The operator workflow is automated end-to-end. From a Kali365 web panel (hosted on bullet-proof infrastructure behind Cloudflare and rotating .top / .shop / .cfd domains), the attacker selects an AI-generated lure (Teams meeting invite, IT helpdesk re-authentication notice, document share, vendor invoice). Kali365 backend calls the Microsoft OAuth devicecode endpoint with first-party client_ids commonly trusted in enterprises — most frequently 04b07795-8ddb-461a-bbee-02f9e1bf7b46 (Azure CLI), d3590ed6-52b3-4102-aeff-aad2292ab01c (Microsoft Office), 1950a258-227b-4e31-a9cf-717495945fc2 (Azure PowerShell), and 14d82eec-204b-4c2f-b7e8-296a70dab67e (Microsoft Graph PowerShell) — and requests scopes such as offline_access, openid, profile, Mail.ReadWrite, Files.ReadWrite.All, User.Read, Directory.Read.All, and Sites.Read.All. Microsoft returns a short-lived (~15 minute) user_code and a verification_uri (microsoft.com/devicelogin or microsoft.com/deviceauth). Kali365 then renders these inside an AI-tailored email body and dispatches the campaign via compromised SendGrid, Brevo and Mailgun accounts (and increasingly through trusted compromised tenants to gain inbox-placement reputation).

When the targeted user clicks the link, they land on the real Microsoft device login page — there is no fake page. The victim enters the attacker-supplied code, completes their normal MFA challenge (FIDO2, Microsoft Authenticator, TOTP, or text), and consents — at which point Microsoft issues the access_token and refresh_token to the attacker's polling backend. Because the user performed full MFA on Microsoft's real surface, the tenant Sign-in logs record a successful interactive sign-in with strongAuthentication = true, often from a residential-proxy IP geolocated near the victim. The refresh_token is long-lived (90 days rolling for most tenants without Conditional Access token-lifetime policies) and can be silently refreshed to maintain persistence.

With tokens in hand, Kali365 operators run automated post-exploitation playbooks: enumerate the mailbox via Graph /me/messages, harvest contacts and global address list, create hidden Outlook inbox rules to forward or delete messages matching keywords like 'invoice', 'wire', 'payroll', register a new Authenticator device through MySecurityInfo to seed long-term persistence even after a password reset, exfiltrate OneDrive and SharePoint documents via batched Graph requests, send internal BEC lures from the victim mailbox, and pivot to Teams chats. Higher-tier Kali365 subscribers receive a 'Tenant Recon' module that maps the directory through Graph /organization and /users to identify Global Administrators and conditional-access policies before targeting.

Kali365 is sold on a tiered subscription via Telegram bot @kali365_support_bot with 'Starter' ($300/week), 'Pro' ($1,200/month) and 'Enterprise' ($3,500/month) tiers that unlock concurrent campaigns, AI lure variants, residential proxy egress, and 24/7 operator chat. The platform shares operators and infrastructure overlap with the older EvilTokens kit referenced in adjacent reporting; Microsoft Threat Intelligence and Volexity have linked some Kali365 campaigns to financially-motivated cluster Storm-1755 and to opportunistic abuse by Russian-aligned APT29 / Midnight Blizzard, which has used device-code phishing in prior espionage operations (a TTP first publicly detailed by Volexity in August 2024).

Detection is hard because the entire authentication transaction is legitimate from Microsoft's perspective. The single high-fidelity signal is in Entra ID Sign-in logs: AuthenticationProtocol = 'deviceCode' for users who do not normally consume that protocol, combined with mismatched client/user-agent (e.g. Azure CLI client_id from a browser-class user-agent) and impossible geography between the user's prior sign-ins and the attacker's polling IP. Defenders should disable device code flow via Conditional Access (grantControls -> block deviceCode authentication protocol) for all users that do not require it, enforce token protection / continuous access evaluation, and hunt for anomalous offline_access refresh-token activity. Remediation when compromised requires revoking refresh tokens (Revoke-AzureADUserAllRefreshToken), removing rogue Authenticator devices, deleting attacker-created inbox rules, and rotating any service-principal credentials touched by the compromised user.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1583.003 Virtual Private Server
- T1583.006 Web Services
- T1586 Compromise Accounts
- T1585.002 Email Accounts
- T1588.002 Tool
- T1587.001 Malware
- T1608.005 Link Target
- T1566 Phishing
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1199 Trusted Relationship
- T1078.004 Cloud Accounts
- T1528 Steal Application Access Token
- T1539 Steal Web Session Cookie
- T1606.002 SAML Tokens
- T1098.005 Device Registration
- T1098.002 Additional Email Delegate Permissions
- T1098.003 Additional Cloud Roles
- T1137.005 Outlook Rules
- T1550.001 Application Access Token
- T1550.004 Web Session Cookie
- T1564.008 Email Hiding Rules
- T1556.006 Multi-Factor Authentication
- T1087.004 Cloud Account
- T1087.003 Email Account
- T1526 Cloud Service Discovery
- T1069.003 Cloud Groups
- T1534 Internal Spearphishing
- T1114.002 Remote Email Collection
- T1114.003 Email Forwarding Rule
- T1213.002 Sharepoint
- T1530 Data from Cloud Storage
- T1102.002 Bidirectional Communication
- T1071.001 Web Protocols
- T1567.002 Exfiltration to Cloud Storage
- T1537 Transfer Data to Cloud Account
- T1657 Financial Theft

## Sources

- [FBI PSA Alert I-052126-PSA — Kali365 Phishing-as-a-Service](https://www.ic3.gov/)
- [Microsoft 365 users targeted by new phishing threat that bypasses MFA — Help Net Security](https://www.helpnetsecurity.com/2026/05/22/kali365-microsoft-365-phishing-fbi-warning/)
- [FBI Warns of Kali365 Attacking Microsoft 365 Users to Steal Logins and Bypass MFA — Cyber Security News](https://cybersecuritynews.com/kali365-phaas-microsoft-365/)
- [RFC 8628 — OAuth 2.0 Device Authorization Grant](https://www.rfc-editor.org/rfc/rfc8628)
- [Microsoft identity platform and OAuth 2.0 device authorization grant flow](https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-device-code)
- [Volexity — Russian SVR Targets Microsoft 365 Accounts via Device Code Phishing (Midnight Blizzard / APT29)](https://www.volexity.com/blog/2024/08/15/russian-svr-targets-microsoft-365-accounts-with-device-code-phishing/)
- [Microsoft Threat Intelligence — Storm-2372 conducts device code phishing campaign](https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/)
- [Microsoft Entra ID Conditional Access — Block authentication flows (deviceCode)](https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows)
- [Mandiant — Phishing-as-a-Service evolution: AiTM, Token Theft, and Device Code Abuse](https://cloud.google.com/blog/topics/threat-intelligence/phishing-as-a-service-evolution)
- [MITRE ATT&CK T1528 — Steal Application Access Token](https://attack.mitre.org/techniques/T1528/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0560