LOWApt
Global

FBI warns of Kali365 phishing-as-a-service after April Microsoft 365 attacks

·Source: The Record

Updated:

Executive Summary

The law enforcement agency published an advisory on Thursday about Kali365 — a Telegram-based service for cybercriminals that allows them to capture legitimate "OAuth" tokens enabling widespread access to Microsoft 365 environments.

Analysis

The law enforcement agency published an advisory on Thursday about Kali365 — a Telegram-based service for cybercriminals that allows them to capture legitimate "OAuth" tokens enabling widespread access to Microsoft 365 environments.
Source Attribution

Originally published by The Record on May 22, 2026.

Related Threats

MEDIUMApt

New Telecom Espionage Campaign Tied to China

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/new-telecom-espionage-campaign-tied-to-china-image_small-5-a-31763.jpg" align=right hspace=4><b>Researchers Trace Linux and Windows Toolsets to Suspected PRC Espionage Activity</b><br>Newly discovered malware tied to China-linked actors breached telecom providers across Asia and the Middle East, highlighting growing efforts to gai

Bank Info Security
LOWApt

FBI warns of Kali Oauth stealers

The FBI has warned of the danger from a new wave of phishing attack s generated by a tool called Kali365. It enables cyber criminals to obtain Microsoft 365 access tokens and bypass multi-factor authentication (MFA) protocols without intercepting the user’s credentials by capturing Oauth tokens linked to the victim’s Microsoft 365 account. The scam works in a similar way to most phishing attacks .

CSO Online
MEDIUMApt

Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns

Unit 42 details Screening Serpens' use of AppDomainManager hijacking and new RAT variants to target tech and defense sectors in recent campaigns. The post Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns appeared first on Unit 42 .

Unit 42 (Palo Alto)