The FBI warned that Kali365 can hijack Microsoft 365 accounts by abusing device code authentication and capturing OAuth ...

Kali365 phishing attacks bypass Microsoft 365 MFA by stealing access tokens. Real Microsoft device sign-in pages make Kali365 phishing lures harder to detect. Defenders should restrict device code ...

A new phishing kit is being offered on Telegram allowing even newbie hackers an easy way to grab OAuth tokens.

A new phishing-as-a-service (PhaaS) campaign is abusing Microsoft’s device code authentication flow to gain unauthorized access to user accounts. Sekoia researchers first spotted the toolkit ...