The FBI has warned Microsoft 365 users about a fast-growing phishing campaign called Kali365 that allows cybercriminals to access Outlook, Teams and OneDrive accounts without passwords.
FBI Issues Urgent Scam Alert for Microsoft Teams, Outlook and OneDrive Users Over New Kali365 Phishing Threat
The Federal Bureau of Investigation (FBI) has issued an urgent cybersecurity warning for millions of Microsoft 365 users, highlighting a rapidly growing phishing campaign known as Kali365. The threat specifically targets users of Microsoft Teams, Outlook, and OneDrive, enabling cybercriminals to gain unauthorized access to accounts without stealing passwords.
According to the FBI, Kali365 operates as a “Phishing-as-a-Service” platform that lowers the barrier for cybercriminals by providing AI-generated phishing templates, automated attack tools, and OAuth token-capturing capabilities. The platform has reportedly been circulating through Telegram channels since April 2026 and is already being used in large-scale attacks against Microsoft 365 users.
Unlike traditional phishing scams that attempt to steal usernames and passwords, Kali365 exploits Microsoft’s legitimate device authentication process. Victims receive convincing emails that appear to originate from trusted cloud services. The message includes a device verification code and instructions to enter it on an official Microsoft login page. Once the code is entered, attackers capture OAuth authentication tokens, allowing them to access Outlook emails, Teams communications, and OneDrive files while bypassing multi-factor authentication (MFA).
Cybersecurity experts warn that this attack is particularly dangerous because users interact with a genuine Microsoft website, making the scam difficult to identify. The FBI has advised users to never enter device codes they did not personally request, review active account sessions regularly, and report suspicious activity immediately. Organizations are also encouraged to strengthen monitoring systems and conduct cybersecurity awareness training for employees.
As phishing attacks become increasingly sophisticated through AI-powered tools, the FBI’s latest warning serves as a reminder that vigilance remains one of the strongest defenses against evolving cyber threats targeting digital workplaces worldwide.
