How can you recognize Kali365 PhaaS Kit Steals Microsoft 365 Access via OAuth Device Code Bypass?

How it works

A new phishing as a service platform called Kali365 is making Microsoft 365 accounts easier to compromise. Sold via Telegram, it lets even non technical attackers capture OAuth tokens and bypass MFA entirely—no passwords stolen, no...

Red flags

• Never enter device codes from unsolicited emails—Microsoft never sends verification codes via email
• Review connected devices in your Microsoft account settings and remove any unrecognized sessions
• If you receive a suspicious verification request, deny it and report it at ic3.gov This threat affects any Microsoft 365 user—pe

What to do

1. 1Sold via Telegram, it lets even non technical attackers capture OAuth tokens and bypass MFA entirely—no passwords stolen, no credential interception needed.
2. 2How the attack unfolds: You receive an email impersonating a trusted cloud service (Microsoft, Dropbox, etc.) containing a "device code" and instructions to verify on the real Microsoft login page.
3. 3Three red flags to watch: Unexpected emails asking you to verify a "device code" or "authorization code" Urgency language to complete verification quickly Links directing you to Microsoft verification pages from third party emails Three actions to take now: 1.

Source

FAQ