FBI alerts on Kali365 AI phishing stealing Microsoft 365 tokens

THE FBI has issued a warning about a new phishing-as-a-service platform called Kali365, discovered in April 2026, which primarily operates on Telegram. This tool allows cybercriminals to use AI-generated phishing methods to capture Microsoft 365 OAuth tokens, enabling them to bypass multifactor authentication. The attack involves sending a phishing email that misleads victims into authorizing access to their Microsoft accounts without realizing it. To combat these attacks, the FBI suggests implementing conditional access policies and restricting device code flows.