FBI warns Microsoft users about passwordless scam

The security step many of us trust most may not protect us the way we think. The FBI is warning about an emerging phishing-as-a-service platform called Kali365. It targets Microsoft 365 accounts, including Outlook, Teams and OneDrive.

That alone sounds bad. The scarier part is how it works. This scam can get into your account without stealing your password. Even with multifactor authentication turned on, one wrong device-code approval could give a criminal access.

Here's how the scam works, why it can slip past MFA and what you can do to protect your Microsoft account.

Sign up for my FREE CyberGuy Report

NEW FBI WARNING REVEALS PHISHING ATTACKS HITTING PRIVATE CHATS

Kali365 is a phishing-as-a-service platform. In other words, crooks can subscribe to it and use ready-made tools to attack Microsoft 365 accounts. The FBI says Kali365 was first seen in April 2026 and has mainly spread through Telegram. The platform gives attackers access to AI-generated phishing messages, automated campaign templates, tracking dashboards and tools that capture OAuth tokens. That last part is the key.

OAuth tokens are digital access keys. They can let an app stay connected to your Microsoft account without asking for your password every time. They are useful when the right app uses them. They are dangerous when a scammer steals them.

Most phishing scams try to steal your password. Kali365 takes a different route. The attack abuses Microsoft's device code login process. You may have seen something similar when signing into a streaming app on a smart TV. A screen shows a short code. Then you enter that code on another device to approve the sign-in.

That process is legitimate. The scam begins when a criminal starts the sign-in from their own device and tricks you into approving it. You may see a phishing email that looks like it came from a trusted cloud service or document-sharing tool. The message includes a code and tells you to visit a real Microsoft verification page.

That real Microsoft page is what makes this so sneaky. The web address can look right. Your password manager may not object. The page may feel safe. But once the code gets entered, you may unknowingly authorize the attacker's device. From there, the attacker can capture access and refresh tokens. That can open the door to Outlook, Teams and OneDrive without your password or another MFA prompt.

QR CODE EMAIL SCAM TARGETS EMPLOYEE REVIEWS

A scam like this can hit anyone with Microsoft 365 access. Still, small businesses should pay close attention. Think about what sits inside a typical work account. Email threads. Invoices. Shared files. Employee chats. Vendor contacts. Customer details. Calendar invites. One compromised account can give a criminal a very believable voice.

A scammer who gets into Outlook can study how you write. They can send messages from your real account. They can ask coworkers to pay fake invoices, share files or reset passwords. That to me is scary because the scam may not look like a scam anymore. It may come from someone you know.

The FBI describes the scheme in a clear sequence. First, the victim gets a phishing email that pretends to come from a trusted productivity or file-sharing service. Next, the email provides a device code and tells the victim to enter it on a legitimate Microsoft verification page.

Then, the victim enters the code and unknowingly approves the attacker's device. After that, the attacker captures OAuth access and refresh tokens. Finally, the attacker can access Microsoft 365 services such as Outlook, Teams and OneDrive without needing the victim's password.

The biggest warning sign is an unexpected request to enter a Microsoft device code. Be suspicious if an email tells you to enter a code for a file, voicemail, invoice or shared document you did not request.

Also, watch for urgency. Scammers love messages that push you to act fast. They may claim a document will expire, a voicemail is waiting, or an account needs verification.

Another clue is context. If you were not trying to sign in to a device, do not enter a device code. That one habit can stop this scam before it starts.

In response to CyberGuy, Microsoft said customers should follow the FBI's recommendations as well as Microsoft's published best practices to protect against Kali365 and similar scams.

The company also said it works to disrupt cybercriminal ecosystems tied to phishing-as-a-service and account takeover activity. Microsoft pointed to recent Digital Crimes Unit actions involving Fake ONNX, RaccoonO365 and Tycoon 2FA as examples of those broader efforts.

A few smart habits can help you spot fake device-code requests, reduce your exposure and follow the FBI’s guidance for limiting this type of attack.

Only enter a Microsoft device code when you personally started the sign-in. If the code arrives through an email, Teams message or random document link, stop.

Do not use links inside surprise messages. Open your browser and go directly to Microsoft or your company's Microsoft 365 portal.

Review recent sign-ins, connected devices and active sessions. If you see a location, device or app you do not recognize, take action right away.

If you think you entered a code by mistake, sign out of all sessions and revoke suspicious app access. Then change your password and contact your IT team.

Do not turn off multifactor authentication because of this scam. MFA still blocks many account attacks. This threat shows why you also need to be careful with approval prompts and device codes.

Using strong antivirus software can help detect phishing pages, malicious links and suspicious downloads before they cause damage. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

Scammers often build convincing phishing messages with personal details found online. A data removal service can help reduce the amount of your information available on people-search sites and data broker databases. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Employees may know not to type passwords into strange pages. Many have never been warned about device codes. Make this specific scam part of your security training.

The FBI says restricting device code flow can help prevent or limit this style of attack. IT teams should create a conditional access policy to block device code flow for all users, with limited exceptions for required business processes.

Before blocking device code flow, the FBI recommends auditing current usage to identify legitimate business needs. That can help prevent disruptions for employees or systems that rely on this sign-in method.

The FBI also recommends blocking authentication transfer policies. This can help prevent users from transferring authentication from computers to mobile devices.

If your organization cannot fully restrict device code flow, the FBI recommends excluding emergency access accounts to prevent lockouts. That step should be handled carefully by your IT or security team.

If you were targeted or compromised, report it to the FBI's Internet Crime Complaint Center at IC3.gov. Include phishing emails, email headers, suspicious login times, IP addresses, locations, unauthorized devices and active sessions.

Move quickly.

This is the kind of scam that can fool smart people because it uses a real Microsoft sign-in page to pull off something criminal. That is what makes Kali365 so dangerous. It can turn a trusted security step into a trap, especially when the code did not come from a signed-in user. The big takeaway here is to slow down before entering any Microsoft device code. If a code shows up through an unexpected email, text or Teams message, stop and go directly to the account instead. Do not approve a sign-in unless it was started on purpose. A few extra seconds of caution can help keep criminals out of Outlook, Teams, OneDrive and everything connected to them.

Have you ever received a Microsoft code or login prompt you did not request, and did it look convincing enough to make you pause? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report

Copyright 2026 CyberGuy.com. All rights reserved.