The Top Most Convenient Products To Buy Online

Cybercriminals are using fake Microsoft login requests to bypass multi-factor security

By Mark Huffman of ConsumerAffairs

• The FBI warned on May 21 that cybercriminals are increasingly targeting Microsoft 365 users with sophisticated phishing .

• The scam uses a tool called Kali365 to steal account access tokens and bypass multi-factor authentication protections.

• Officials say the attacks rely on fake Microsoft login requests and social engineering tactics designed to trick users into handing over access.

The FBI is warning Microsoft users to be on alert after identifying a fast-growing phishing campaign that allows scammers to bypass common account security protections and gain access to sensitive information.

In a public service alert, the FBI said cybercriminals are using a phishing-as-a-service platform called Kali365 to target Microsoft 365 accounts. The tool enables attackers to steal OAuth access tokens, giving them persistent access to accounts without needing passwords or repeatedly triggering multi-factor authentication (MFA).

According to the FBI, the service first appeared in April and is being distributed through Telegram channels. The agency said the platform lowers the barrier for cybercrime by offering automated phishing templates, AI-generated scam emails, and dashboards that track victims in real time.

It starts with an email

The typically begin with an email that appears to come from a trusted cloud service or document-sharing platform. Victims are instructed to visit a legitimate Microsoft verification page and enter a device code supplied in the email. Once the code is entered, attackers can capture authentication tokens and gain access to services such as Outlook, Teams, and OneDrive.

Because the attacks exploit Microsofts legitimate authentication workflow, they can be difficult for users and security systems to detect. Cybersecurity experts say the method is especially dangerous because it bypasses MFA protections that many users rely on to secure their accounts.

The potential damage

The FBI warned that compromised accounts can expose sensitive business information, personal data, and financial records. Attackers may also use stolen access to launch additional phishing attacks from legitimate accounts, making future appear more credible.

Microsoft recently reported a separate sophisticated phishing campaign that targeted more than 35,000 users across 13,000 organizations in 26 countries, with most victims located in the United States. Researchers said attackers used polished corporate-style emails and fake internal communications to trick recipients into surrendering credentials and authentication tokens.

Federal authorities are urging users to avoid clicking links in unsolicited emails, verify login requests independently, and never enter device codes unless they initiated the request themselves. The FBI also recommends enabling phishing-resistant MFA methods, monitoring account activity, and reporting suspicious messages to the FBIs Internet Crime Complaint Center.

The warning reflects a broader trend toward increasingly sophisticated phishing operations that rely more on social engineering than traditional malware. Security researchers say these are becoming more convincing through the use of AI-generated messages, professional-looking templates, and legitimate cloud infrastructure.