FBI warns of new phishing attack that steals Outlook, Teams and OneDrive accounts without passwords
The agency has issued an urgent alert to millions of Outlook, Teams and OneDrive users. A sophisticated new attack called Kali365 allows cybercriminals to access your Microsoft 365 accounts without stealing your password or getting past two-factor authentication (MFA).
The FBI alert about a new threat that puts millions of Microsoft 365 accounts at risk. The federal agency issued an urgent warning on May 21, 2026 about Kali365, a Phishing-as-a-Service (PhaaS) service that allows cybercriminals to access accounts on Outlook, Teams and OneDrive accounts without stealing passwords or defeating two-factor authentication (MFA).
What is Kali365 and why is it so dangerous?
Kali365 is a phishing platform sold on a subscription basis (approximately $250 per month) primarily on Telegram. It was first detected in April 2026 and has quickly gained popularity among cybercriminals, even those with little technical expertise.
Unlike traditional phishing attacks, Kali365 does not attempt to steal your password. Instead, it uses a technique called "device code phishing" that exploits Microsoft's legitimate authentication flow.
Here's how the step-by-step attack works:
Who is at risk?
- Individual users with personal or work Microsoft 365 accounts.
- Companies of any size using Outlook, Teams and OneDrive.
- Organizations that rely solely on traditional multi-factor authentication.
According to the FBI, this type of attack allows persistent access that can be used for data theft, corporate espionage, extortion or as a gateway for ransomware.
Official FBI recommendations to protect yourself
The FBI recommends the following immediate steps:
- Always verify senders and don't enter device codes if you receive unexpected requests.
- Use Conditional Access Policies (in enterprise environments) to restrict access by location, device or risk.
- Regularly review apps with permissions on your Microsoft account (myapps.microsoft.com).
- Review suspicious tokens immediately.
- Turn on sign-in alerts in Microsoft 365.
- Train your team to recognize this new type of phishing.
What to do if you think you were a victim?
LATEST
Toasts, a Meatless Menu and A-List Guests: Inside Trump's State Dinner for Xi Jinping
New Jersey's Democratic governor calls for her lieutenant governor's resignation following a sexual harassment investigation
'Let her in': Colombia's former vice president calls for María Corina Machado's return to help push for elections in Venezuela
The Trump administration is appealing to the Supreme Court to resume the deportation of immigrants to third countries
The GOP shows its divisions over Iran: The Senate blocks an attempt to withdraw the US from war with Iran, but four republicans support the resolution
Between the war with Iran and inflation, US mortgage rates climb back above 7%
Federal appeals court clears Ohio to require proof of citizenship to register to vote again
Jim Copenhaver, one of the aides wounded in the attack on Donald Trump in Pennsylvania, has died
🛠 Do you think there is an error in this article?
Recommendations
LATEST
