FBI Warns Microsoft 365 Users Of New Hacking Tool That Is Scamming Thousands: Here's All You Need To Know

The FBI has warned about a phishing tool called Kali365 that can bypass two-factor authentication on Microsoft 365 accounts.
WeLiveSecurity

EvilTokens: A phishing attack that doesn’t steal your password

A phishing kit subverting Microsoft’s legitimate authentication flow lets attackers break into accounts without stealing ...

The attack dominating financial services doesn't steal passwords. It resets MFA and steals the token.

Credential theft fell to 13% of breach vectors in 2026. Attackers now bypass MFA via help desk resets and OAuth token theft.

FBI Warns: ‘Kali365’ Phishing Service Targets Microsoft 365 Accounts

The FBI warned that Kali365 can hijack Microsoft 365 accounts by abusing device code authentication and capturing OAuth tokens.

FBI warns Microsoft users of Kali365 scam duping thousands: How the scam works and how users can protect themselves

The Federal Bureau of Investigation (FBI) issued a Public Service Announcement (PSA), warning the public about an emerging ...