FBI issues warning about Kali365 phishing scam that bypasses MFA in Microsoft 365 accounts

A serious cyber threat has emerged, prompting the US Federal Bureau of Investigation (FBI) to release an official statement this Monday. The American government agency has warned about a new phishing scam designed to directly attack users of the Microsoft 365 platform.

This malicious attack is centered on the Kali365 platform, identified by the FBI as a sophisticated “Phishing-as-a-Service” system. This dangerous tool, largely disseminated via Telegram, allows cybercriminals to bypass multifactor security authentication without needing victims’ access passwords.

The mode of operation involves sending fraudulent email messages in which attackers pose as legitimate cloud services or file-sharing platforms. These fake communications present codes and direct users to a verification page pretending to be from Microsoft, asking them to enter the code. By entering the code on the device, the victim, without knowing it, grants permission for the attacker’s equipment to access their account.

After the successful completion of this fraud, cyber attackers gain full control over the injured individual’s various Microsoft resources. This ranges from your Outlook email inbox and Teams communication tools to OneDrive cloud storage, profoundly impacting data privacy and security.

In its public service announcement, the FBI noted that “Kali365 simplifies the attack process by giving less technically savvy attackers access to AI-powered phishing traps, automated campaign schemes, real-time user and entity monitoring dashboards, and capabilities to capture OAuth tokens.”

The first identification of the Kali365 scam by the FBI occurred in April this year, marking the beginning of the investigation. To protect users, the agency provided a set of essential guidelines, advising the reporting of questionable emails or access from unrecognized devices to the Internet Crime Complaints Center (IC3). Furthermore, the federal agency emphasizes the importance of never clicking on links that contain unsolicited access codes.