You Did Everything Right. Real Page, Valid Certificate, MFA Approved — and They're In.

FBI Warning MFA Bypass

July 2026  ·  7 min read

In a public service announcement, the FBI warned businesses about Kali365 — a "phishing-as-a-service" kit rented over Telegram for as little as $250 a month. It steals Microsoft 365 access without ever touching your password, and it walks straight past multi-factor authentication. You don't need to be a hacker to use it. You just need a subscription. Here's how it works, and the one setting that shuts it down.

---

For years, the reassuring story about cybercriminals was that real attacks required real skill. Building convincing phishing infrastructure, evading detection, bypassing multi-factor authentication — that took expertise most criminals didn't have. The barrier to entry was your friend.

That barrier just collapsed. On May 21, 2026, the FBI issued a public service announcement (PSA I-052126) warning businesses about a new tool called Kali365 — and the warning is worth every small business owner's attention, because it represents a fundamental shift in who can attack you and how easily.

Kali365 is "phishing-as-a-service." It's a crime kit sold by subscription, rented over the messaging app Telegram for as little as $250 for 30 days. You don't build anything. You don't need technical skill. You subscribe, point it at a list of targets, and the software does the work — including the part that used to be hardest: getting past multi-factor authentication.

$250

the monthly subscription price to rent a tool that breaks into Microsoft 365 accounts and bypasses MFA

For roughly the cost of a business software subscription, someone with almost no hacking ability can now run attacks that used to require an expert. The subscription includes AI-generated phishing emails free of the typos that used to give scams away, ready-made templates impersonating trusted services, a live dashboard tracking which targets have taken the bait, and the infrastructure to steal Microsoft 365 access tokens. It industrializes what used to be artisanal.

Here's the part that should make every business owner sit up: Kali365 works even when your multi-factor authentication is fully deployed and working exactly as designed. It doesn't defeat MFA by cracking it. It sidesteps it entirely — by stealing the token that proves you already passed the MFA check. And it does this without ever capturing your password.

How the attack actually works — and why it's so hard to spot

The genius and the danger of Kali365 is that it abuses a legitimate Microsoft feature. There's no fake website. No misspelled domain. No spoofed login page. The victim authenticates on the real microsoft.com, using their real password and their real authenticator app. Here's the sequence:

Anatomy of a device-code phishing attack

1

The lure. You receive a phishing email — AI-generated, clean, no typos — impersonating a trusted service like SharePoint, DocuSign, or Adobe Acrobat Sign. It asks you to verify your identity by entering a short code at a Microsoft page.

2

The real page. You go to the genuine Microsoft verification page — microsoft.com/devicelogin — and enter the code. Everything looks correct because everything IS correct: real domain, valid certificate, your own password manager recognizes it.

3

The MFA prompt. You complete your normal MFA — approve the push, enter the code, tap the key. From your point of view, you've just done the safe, responsible thing you've been trained to do.

4

The handoff. What you actually did was authorize the attacker's device. Microsoft hands them an OAuth token — proof you're logged in — granting access to your Outlook, Teams, and OneDrive. No password needed. No further MFA prompts.

5

The persistence. With the token, the attacker has standing access. They often create hidden inbox rules to suppress alerts and register their device in your environment — deepening access while staying invisible.

This is why the attack is so dangerous: you did nothing an awareness training would flag. You checked the domain — it was real. You checked the certificate — it was valid. You completed your MFA — correctly. There was no fake website to spot. The single stolen token can unlock every cloud app connected to your Microsoft sign-on, turning one careful click into a wide-ranging breach. And because your password was never stolen, the usual security alerts may never fire.

340+ organizations hit across five countries by an earlier wave of the same device-code technique before the commercial kit even launched Cloud Security Alliance / Huntress 2026

No password is ever stolen — and MFA is never cracked. The attack steals the token issued after you pass MFA, sidestepping both entirely FBI PSA I-052126, May 2026

Hundreds of Kali365 attacks documented in April 2026 alone, hitting organizations across North America and Europe within weeks of launch Arctic Wolf / Bitdefender 2026

If the OAuth-token mechanism sounds familiar, it should. It's the same class of attack as the dead-credential supply-chain breach we covered last week — an attacker using a stolen or fraudulently issued token to walk into cloud systems as a trusted, already-authenticated user. The difference is the delivery: that breach exploited one forgotten credential. Kali365 sells the capability to steal fresh tokens, at scale, to anyone with $250. The technique is now a product.

Why this matters more for small businesses

The campaigns using this technique have targeted manufacturing, education, insurance, financial services, healthcare, and government — a spread that tells you attackers aren't being selective. When the tool is this cheap and this automated, there's no reason to target only large organizations. The economics of "phishing-as-a-service" reward volume, and small businesses running Microsoft 365 are the largest pool of targets in the world.

Small businesses are also less likely to have configured the specific setting that stops this attack — because until the FBI's warning, few had reason to know it existed. That's the good news hiding in this story: the single most effective defense is a configuration change most businesses can make inside settings they already pay for.

The four defenses — starting with the one that shuts it down

1

Block device code flow — the single setting that closes the door

The #1 FBI fix · Free

The FBI's top recommendation is direct: block the device code authentication flow. This is the specific mechanism Kali365 abuses, and most businesses have no legitimate need for it. Blocking it closes the exact door this attack walks through — without affecting normal sign-ins.

Have your IT admin do thisIn Microsoft Entra, create a Conditional Access policy that blocks the device code authentication flow for all users. Review sign-in logs first to spot any legitimate use (rare — mostly shared meeting-room hardware), and exclude your emergency "break-glass" admin accounts so a misconfiguration can't lock you out. This one policy neutralizes the specific attack.

2

Upgrade to phishing-resistant MFA

Configuration · Low cost

Push notifications, text codes, and authenticator codes can all be relayed to an attacker in a token-theft attack. Phishing-resistant MFA — passkeys or FIDO2 hardware security keys — ties authentication to a physical device, making the token far harder to hijack. It's the durable answer as these attacks evolve.

Prioritize thisRoll out passkeys or hardware security keys, starting with your highest-privilege accounts — admins, finance, executives. Microsoft is making passkeys the default for Entra ID enterprise sign-in later in 2026; getting ahead of that shift now closes your biggest exposure first.

3

Be able to revoke a stolen session in minutes

Process · Free

Because this attack grants a standing token, the critical question after a suspected compromise is how fast you can invalidate it. A password reset alone doesn't kill a stolen token — you have to revoke the sessions. Knowing how to do this before you need to is the difference between a contained incident and a widening one.

Know the path nowIn Microsoft 365 admin center → Active users → select user → "Sign out of all sessions," and revoke refresh tokens. Document this as a step in your incident response plan. Practice it once so it's muscle memory when it counts.

4

Teach the team the one rule that beats this specific lure

Training · Free

Traditional phishing training — check the domain, look for typos — doesn't help here, because the domain is real. The rule that does help is specific: never enter a device code you didn't personally initiate. If an email asks you to go enter a code somewhere, that's the red flag, even if the page it sends you to is genuinely Microsoft's.

The message to send your team"If you get an email asking you to enter a code on a Microsoft page — and you didn't just try to sign in to something yourself — stop. Don't enter it. Report it. A code you didn't ask for is someone trying to log in as you."

The Veriti Spottr CyberScore's Security Posture survey assesses exactly the identity and authentication controls this attack targets — MFA strength, session management, and the conditional-access hardening the FBI now recommends. The Exposure component watches for the credential and token signals that precede account takeover. Kali365 turned a sophisticated attack into a $250 subscription. Your CyberScore tells you whether the defenses that neutralize it are actually in place — before a code you didn't ask for shows up in someone's inbox.

The bigger shift this represents

Kali365 is one product, and by the time you read this the FBI's warning may have driven it underground or a competitor may have replaced it — other kits using the same technique already exist. But the trend it represents is permanent: the most capable attack techniques are being packaged, automated, and sold as subscriptions to people who couldn't have built them. The skill barrier that used to protect small businesses is gone.

The response isn't panic — it's the same discipline this whole series has argued for. The attack is sophisticated; the defense is a configuration change and a clear rule. Block the device code flow. Upgrade your MFA. Know how to revoke a session. Tell your team the one rule. Four steps, most of them free, against a threat that costs your attacker $250 a month. That asymmetry — cheap attack, cheaper defense — is still, even now, on your side. But only if you use it.

📚 Credential Security Series — Read the full series

Part 1 → Your Password Policy Isn't Protecting You. Your Employees' Habits Are. Part 2 → Your Credentials Are Already For Sale. Here's How to Find Out in 60 Seconds. Part 3 → You Turned MFA On. Attackers Already Have Three Ways Around It. Part 4 → What Attackers Do With Your Data in the First 60 Minutes Part 5 → The 30-Minute Security Audit Every SMB Owner Should Do This Week Part 6 → The First 24 Hours After You Discover a Breach

Find out if the defenses that stop this are actually in place. Veriti Spottr's beta is free.

Get your CyberScore →

VS

Veriti Spottr Team AI-powered cyber risk clarity for SMBs  ·  veritispottr.com

\