Kali365 Phishing Platform Exploits Microsoft Authentication Flows

A new phishing-as-a-service (PhaaS) platform called Kali365 has emerged, targeting US enterprises that use Microsoft 365. The platform exploits the device code authentication flow in Microsoft's OAuth 2.0 system, allowing attackers to bypass multi-factor authentication and gain persistent access to cloud environments.

Kali365 is a commercialized PhaaS platform available by subscription for approximately $250 per month or $2,000 per year. It offers AI-generated phishing lures, automated campaign orchestration, real-time dashboards, and robust OAuth token capture capabilities.

The platform has been responsible for over 80 public attack sessions per week, with the United States as the primary target. The FBI issued a public service announcement in May 2026 warning of the campaign's ability to bypass MFA and compromise Microsoft 365 environments without password theft.