Kali365 phishing kit bypasses MFA and steals Microsoft logins

When the Federal Bureau of Investigation (FBI) publishes a dedicated public service announcement about a new phishing kit, it’s worth paying attention to. The agency is now warning about “Kali365,” a phishing‑as‑a‑service (PhaaS) platform that helps even low‑skilled attackers hijack Microsoft 365 accounts by stealing access tokens instead of passwords. Although early reporting focuses on attacks against organizations, the underlying technique works just as easily against individual Microsoft 365