The FBI is warning of a new phishing scam targeting Microsoft Outlook users, with officials saying hackers “hijack” Microsoft 365.
The warning, issued May 21, says the threat first emerged last month as a pre-packaged phishing kit called Kali 365. The platform, primarily distributed through the Telegram message app, then allows cyber actors to obtain Microsoft 365 access tokens and bypass additional security measures like multi-factor authentication.
“Through the Kali365 platform subscription, cyber threat actors can capture “OAuth” tokens and gain persistent access to targeted individuals/entities’ Microsoft 365 environments,” the warning said. The FBI went on to say the platform “lowers the barrier of entry” and allows less-skilled hackers to access AI-generated phishing lures, automated campaign template and more.
How the scam works
The scam starts out when an attacker sends a phishing email impersonating trusted cloud productivity and document-sharing services like Microsoft 365, the FBI said. The email contains a device code with instructions to visit a legitimate Microsoft verification page.
If a user clicks through and follows the instructions, they’ve unknowingly authorized the attacker’s device to access their account, the FBI said. The hacker then captures authorization access and tokens, granting them access to target an individual’s Microsoft 365 account.
“The attacker can now access Microsoft 365 services such as Outlook, Teams, and OneDrive without needing a password or completing any additional MFA challenges,” the FBI said.
The FBI advised those who use 365 to limit how people can sign-in using codes on different devices, and keep backup access available just in case.
Users who believe they were targeted are asked to report it to the Internet Crime Complaint Center.
