Kali365 and Tag B are the two protagonists in a modern security tale, and this piece keeps stakes high while steering toward practical defense. The FBI’s PSA and independent researchers warn that Kali365 is a phishing‑as‑a‑service platform masquerading as a useful toolkit for criminals, built to hijack Microsoft 365 accounts without forcing passwords to walk the plank. Since its emergence in April 2026, Kali365 has circulated through Telegram channels, offering a turnkey set of tools for would‑be attackers. This article keeps the tone accessible to security teams, admins, and curious readers alike.
Kali365’s cleverness lies in its use of the legitimate OAuth 2.0 Device Authorization flow. The device code mechanism exists to help devices with limited input—think smart TVs, conference room panels, streaming sticks, printers, and other IoT devices—authenticate via a separate device using a small code shown on a Microsoft login portal at microsoft.com/devicelogin. In a malicious scenario, attackers initiate the device flow themselves and persuade victims to enter the code on a genuine login page. After MFA is completed, the attacker receives an OAuth access token that unlocks access to the user’s Microsoft Entra and Microsoft 365 environments. The upshot is disarming in its simplicity: the attacker gains broad access without breaking MFA on the victim’s side, a situation that demands stronger controls and smarter monitoring. Microsoft device code flow documentation provides context for how this flow is supposed to work.
Kali365 and PhaaS Make MFA a Target
When token access flows smoothly, MFA becomes a gate that opens for someone else. With a valid session token, attackers can navigate across apps the user normally uses, including Microsoft 365 and other cloud SaaS platforms. The FBI notes that Kali365 democratizes phishing by offering automated templates, real‑time victim tracking, and even AI‑generated lure content for Tag B. In practice, this means a offensively powerful tool can be deployed by a broader set of criminals, turning what used to be a niche operation into a scalable enterprise. Researchers from Arctic Wolf observed campaigns targeting organizations worldwide in April, directing victims to the device‑code login portal and inducing them to authorize access without realizing the risk. The result is a compromised mailbox, clever inbox rules that mask activity, and sometimes the registration of new devices in the victim’s environment—an escalation that expands an attacker’s foothold.
These campaigns also show how Tag B operates as a business model, with admins, resellers, and affiliates conducting phishing campaigns. This dynamic mirrors legitimate software ecosystems in scale and governance, minus the ethics. The campaigns focus on Microsoft Entra environments and Microsoft 365, leveraging phishing emails that push victims toward the device code login portal. Once a code is entered and MFA is completed, attackers obtain an access token and step into the victim’s workspace, able to read mail, set rules, and access calendar data. The technical elegance of the approach lies in its use of a legitimate flow to bypass what many admins consider the primary defense: MFA prompts must be actively re‑presented and validated for each session. The Kali365 model exploits trust in familiar portals and the speed of automation to minimize human friction for criminals.
From a defender’s perspective, the takeaway is sharper incident mapping: trace the device codes, examine device registrations, and scrutinize new session patterns that don’t match typical user behavior. The good news is visibility has improved thanks to cloud‑native security controls and enhanced monitoring dashboards. The field is learning to treat device code flows not as rare curiosities but as a real risk vector that requires explicit policy and routine verification. FBI phishing guidance reinforces the need for layered controls and vigilant monitoring in real time.
What can security teams do right now? The FBI’s guidance is practical and actionable. Where possible, restrict or block device code authentication flows using Conditional Access policies. Audit existing device code usage to confirm legitimate devices and legitimate users. Block authentication transfer policies that allow sessions to hop between devices, a tactic attackers sometimes rely on to maintain access after initial infiltration. Organizations should also preserve phishing emails, suspicious login attempts, and unauthorized device registrations as evidence for investigations and for improving defenses. In practice, this means a blend of policy, logging, and user education. FBI guidance should be treated as a living playbook that evolves with the threat.
Beyond policy, operators should consider stronger MFA modalities that are harder to phish—such as hardware security keys or app‑based approvals that require user interaction outside the phishing flow. Regular phishing simulations, incident response drills, and clear reporting channels help teams stay alert without succumbing to panic when the next lure lands in the inbox. The takeaway remains hopeful: Kali365 and Tag B highlight a threat, but a well‑tuned defense can raise the cost and reduce the success rate of these campaigns.
In the broader context of 2026, device code phishing has become a notable tactic—not a footnote. The industry responds with better controls, more rigorous auditing, and a culture that prioritizes security hygiene. The next wave may bring new variants, but countermeasures grow stronger when practitioners share insights and continually adapt.
Original article reference: BleepingComputer coverage on Kali365 phishing platform. Thank you to the authors for their diligent reporting and for helping the industry stay informed.
Have thoughts to share? Please drop them in the comments below and join the discussion about how to stay safe in an era of clever device code phishing.
FAQ
-
What is device code phishing, and why does it work?
Device code phishing tricks victims into authorizing access on a legitimate login flow, often after attackers initiate the flow themselves. The attacker then uses the resulting token to access the victim’s cloud applications, bypassing the need to steal passwords in many cases.
-
How can organizations reduce risk from Kali365 and Tag B?
Use Conditional Access to block device code flows where possible, monitor device registrations, and enforce strong MFA methods such as hardware keys. Regular phishing simulations and clear incident-response playbooks also help shut down rapid attacker movements.
-
Is MFA enough to stop these attacks?
No. MFA is a strong control but not a silver bullet. Pair MFA with device‑level controls, anomaly detection, and prompt revocation of suspicious sessions to reduce exposure.
References
- BleepingComputer: FBI warns of Kali365 phishing service targeting Microsoft 365 accounts
- Microsoft device code flow documentation
- FBI phishing awareness