FBI warns of Kali365 phishing kit that breaks into Microsoft 365 accounts – no password required

The FBI has issued a warning about Kali365, a phishing-as-a-service kit that allows attackers to compromise Microsoft 365 accounts without needing passwords, even when MFA is enabled. This kit leverages device code flow, exploiting a legitimate Microsoft feature to gain unauthorized access. The attacks have been observ…