FBI warns of sophisticated Kali365 phishing service targeting Microsoft accounts

Coverage from Tech Radar indicates that a sophisticated phishing-as-a-service platform, known as Kali365, Octopi365, and Freedom365, is actively targeting Microsoft accounts. This platform was first identified in May 2026 by cybersecurity firm Huntress, which observed a significant number of Microsoft 365 logins originating from China.

The FBI has issued a public service announcement detailing Kali365's operations. This platform distinguishes itself through its scale and advanced methods, offering at least 33 templates impersonating Microsoft services, 100 API endpoints, and role-based access for phishing teams. It also features AI-generated lures, a crypto payment gateway, and tiered access. Kali365 does not bypass multi-factor authentication directly; instead, it steals session cookies and OAuth tokens by presenting victims with seemingly legitimate Microsoft login pages and SSL certificates. The AI capabilities extend to reading intercepted emails, scoring them for fraud potential, and drafting convincing replies with fabricated details.

The FBI notes the difficulty in avoiding these attacks due to their legitimate appearance and diverse vectors, and the platform's success highlights vulnerabilities in authentication transfer mechanisms.

Source: Tech Radar