FBI sounds alarm on phishing tool that steals Microsoft 365 accounts without passwords

The FBI is warning that a new hacking platform is allowing cybercriminals to hijack Microsoft 365 accounts — including ...

FBI warns of hacking campaign stealing Microsoft 365 accounts without passwords

Cybercriminals are exploiting a new 'Phishing-as-a-Service' tool, Kali365, to bypass Microsoft 365 security, including ...

FBI Warns Microsoft Users—New Attack Gains Access To Accounts

The FBI issued a warning on May 21, as a new AI-powered attack enables "threat actors to obtain Microsoft 365 access tokens ...

FBI Warns: ‘Kali365’ Phishing Service Targets Microsoft 365 Accounts

The FBI warned that Kali365 can hijack Microsoft 365 accounts by abusing device code authentication and capturing OAuth ...
Windows Report

FBI Warns Kali365 Can Bypass Microsoft 365 MFA Using OAuth Tokens

The FBI warns that Kali365 phishing attacks can bypass Microsoft 365 MFA by stealing OAuth session tokens through device code phishing.
Bitdefender

FBI warns of Kali365 phishing kit that breaks into Microsoft 365 accounts — no password required

Surely your Microsoft 365 accounts are safe now? Well, think again. The FBI has issued an advisory warning about a ...

Microsoft warns hackers are exploiting password resets to gain access to user accounts

Storm-2949 is engaged in a "methodical, sophisticated, and multi-layered" campaign ...
HHS

Live Hacking into Microsoft 365

The game has changed. In 2020, cybercriminals used macro-ridden Word documents to record your keystrokes and lurk through your webcam. In 2025, AI and credential marketplaces have made it even easier ...
GCN

How to prepare for Microsoft mandatory MFA enforcement

Time’s running out! Microsoft mandatory MFA enforcement is bulldozing its way into organizations across the globe, and the October 2025 deadline cannot be compromised. The thing is, unlike in earlier ...

FBI warns of Kali365 phishing service targeting Microsoft 365 accounts

The FBI is warning about the Kali365 phishing-as-a-service platform (PhaaS) that is used to hijack Microsoft 365 accounts by abusing OAuth device code authentication to steal session tokens and bypass ...