The FBI has warned about a phishing tool called Kali365 that can bypass two-factor authentication on Microsoft 365 accounts.

The FBI warned that Kali365 can hijack Microsoft 365 accounts by abusing device code authentication and capturing OAuth tokens.

A phishing kit subverting Microsoft’s legitimate authentication flow lets attackers break into accounts without stealing ...

Kali365 targets Microsoft 365 users’ accounts, using a phishing service that doesn’t require password theft despite bypassing the MFA process.

Device codes are alphanumeric or numeric codes employed for authenticating an account on a device that does not have a standard login interface, such as a browser or input-limited devices, where it is ...

The FBI warns that Kali365 phishing attacks can bypass Microsoft 365 MFA by stealing OAuth session tokens through device code phishing.