The FBI Just Issued an Urgent Warning for Anyone Using Microsoft Teams, Outlook, or OneDrive over a New Phishing Scheme

Why It Matters

By circumventing MFA, the Kali365 kit threatens the core security controls of millions of corporate and personal Microsoft 365 accounts, raising the risk of data breaches and financial loss. The low cost and automation lower the barrier for less‑technical attackers, amplifying the potential scale of compromise.

Key Takeaways

• FBI warns of Kali365 token‑theft scheme targeting Microsoft 365 users
• Attack captures OAuth device codes, bypassing MFA without passwords
• Service sold on Telegram for $250/month or $2,000/year
• Phishing emails direct victims to legitimate Microsoft verification page
• Researchers recorded hundreds of attacks in April 2026 alone

Pulse Analysis

The emergence of the Kali365 phishing kit marks a turning point in credential‑theft tactics, shifting the focus from password harvesting to token hijacking. By exploiting OAuth device codes—digital keys that grant applications access without a password—attackers can silently infiltrate Outlook, Teams, and OneDrive. This method sidesteps traditional multi‑factor authentication, rendering one of the most trusted security layers ineffective. The kit’s subscription model, priced at $250 per month, democratizes sophisticated phishing capabilities, allowing even low‑skill actors to launch AI‑generated lures and automated campaigns.

For enterprises, the implications are profound. Microsoft 365 is the backbone of collaboration for countless organizations, and a breach can expose confidential communications, intellectual property, and financial data. The FBI’s alert underscores the urgency for IT teams to adopt token‑monitoring solutions, enforce conditional access policies, and educate users about unsolicited device‑code requests. Traditional email filters may miss these attacks because they direct victims to legitimate Microsoft verification pages, eliminating obvious phishing indicators.

Industry analysts predict a surge in similar token‑theft operations as cybercriminals refine their toolkits. Companies are urged to implement real‑time token revocation, employ zero‑trust architectures, and regularly audit OAuth app permissions. While Microsoft continues to enhance its security protocols, the onus now lies on organizations to layer defenses and stay vigilant against this evolving threat vector.