In May, the FBI warned about Kali365, a phishing service that has been hijacking Microsoft 365 accounts since April 2026. It's sold to criminals through Telegram channels, and it does something most small businesses assume can't happen: it gets past multi-factor authentication without stealing a password or intercepting a code.
How it works
Microsoft has a legitimate sign-in method for devices without a keyboard, such as a meeting-room screen or a smart TV. The device shows a short code, you type that code into Microsoft's sign-in page on your computer, and the device is signed in as you.
Kali365 turns that around. The attacker generates the code. The victim receives an email, often dressed up as a shared document, that leads to a page asking them to enter it. The sign-in page they land on is Microsoft's real one, so nothing looks wrong. They sign in, complete MFA, type the code, and Microsoft hands the attacker a valid session.
Huntress, the security operations centre behind our managed services, traced a wave of these sign-ins in mid-May 2026: more than 80 successful logins on May 20 alone. Its analysts put the time from click to full account access at 42 seconds.
Why a password reset doesn't fix it
The attacker isn't holding your password. They're holding a session token, the digital wristband that proves you've already signed in. MFA already happened, so it never challenges them again, and the token can be renewed to keep access for weeks.
That's why resetting the password on its own doesn't evict them. You also have to revoke the account's active sessions and remove any devices the attacker registered.
What happens next
Once inside, the kit lets attackers read the whole mailbox, flag threads about invoices, wire transfers and payroll, draft convincing replies that redirect a payment, and add inbox rules that hide their tracks. Researchers at Arctic Wolf, who also tracked the kit, saw attackers register new devices in victims' environments to extend their access.
For a small business, that's the path from one click to a redirected supplier payment.
The fix: block device code sign-in
Almost nobody in a typical business needs this sign-in method. The FBI recommends restricting or blocking it with Conditional Access, auditing where it's already used, and blocking authentication transfer between devices. Microsoft and Huntress give the same advice. In Microsoft Entra:
- Create a Conditional Access policy that applies to all users.
- Under Conditions, open Authentication flows and select Device code flow.
- Set access to Block, and exclude only accounts with a documented need, such as a meeting-room device.
Conditional Access needs Microsoft 365 Business Premium or a Microsoft Entra ID P1 licence. If you're on Business Basic or Standard, it's worth a conversation about what you can do instead.
One rule for your team
Never enter a code you didn't ask for. A real shared document will never ask you for one.
How we help
Managed ITDR watches Microsoft 365 sign-ins around the clock for exactly this pattern: logins from cloud hosting providers, unexpected new devices and suspicious inbox rules. When it finds one, the account's sessions can be revoked to cut the attacker off. Managed ISPM puts the device code block in place and keeps it there, and Managed SAT teaches the one rule above.
Want to know whether device code sign-in is open in your tenant right now? Our Microsoft 365 security review checks it, along with the rest of your setup. Book a security call.