Small business owners: a new phishing toolkit is letting attackers break into Microsoft 365 without stealing passwords. The claim isn’t hype—the FBI’s IC3 Public Service Announcement about a Phishing-as-a-Service kit called Kali365 confirms this threat is real and active.
The Kali365 toolkit is designed to obtain and reuse Microsoft 365 access tokens, which can grant attackers ongoing access even if a user changes their password. In short: attackers can bypass traditional password abuse defenses and stay inside your environment longer than a typical phishing email would allow.
What happened
The IC3 PSA describes Kali365 as a ready-made platform that helps threat actors generate and deploy phishing campaigns focused on stealing OAuth/OIDC tokens for Microsoft 365. By obtaining valid tokens, attackers can bypass MFA checks that rely on password-only verification and gain access to mail, files, and collaboration tools. The result is a more durable foothold in targets’ environments than password theft alone.
In practical terms, this means a single compromised user session can silently grant an attacker access to email, SharePoint, Teams, and other Microsoft 365 resources for as long as tokens remain valid or are not revoked.
Why it matters
- Minor teams and solo shops are at risk: attackers don’t need to steal passwords to access sensitive data.
- Phishing may now involve token theft, making detection harder unless you monitor sign-in behavior closely.
- Small businesses often rely on simple security setups; this threat targets the weakest link—human behavior combined with token-based access.
For IT-minded readers, this underscores a shift from password hygiene alone to stronger authentication and better token monitoring. For managers and non-technical owners, it highlights why MFA and strong device-based controls are no longer optional.
Practical steps you can take now
These fixes are actionable and can be tested in a short time frame. They focus on making token theft much harder and making any suspicious activity easier to spot.
- Enable MFA for all users: In the Microsoft 365 admin center, go to Users > Active users and enable multi-factor authentication for everyone. If your tenant supports it, turn on Security Defaults in Azure Active Directory > Properties to enforce MFA across the board.
- Adopt phishing-resistant MFA: In the Azure portal, open Azure Active Directory > Security > Authentication methods and enable Passwordless or FIDO2 security keys for users who can. This helps prevent token misuse even if credentials are compromised.
- Review recent sign-ins and revoke sessions: In Azure Active Directory, check Sign-ins for unusual patterns (off-hours, unfamiliar locations, new devices). If you see something suspicious, select the user and click Revoke Sessions to force re-authentication and invalidate tokens.
- Limit legacy authentication: If you use Security Defaults or Conditional Access, legacy (basic) authentication will be restricted. If you aren’t there yet, enable Security Defaults to require modern authentication and MFA.
- Educate and test your team: Run a quick, internal phishing exercise focused on fake invoices, vendor emails, or payment requests. Use the findings to reinforce red flags (sender domain, invoice details, unusual payment instructions) and verify through a known channel.
If you’re unsure about a step, start with Security Defaults. It’s a straightforward toggle that raises the security baseline for all users and is designed to reduce the risk from token-based phishing attempts.
Final thought
Kali365 is a reminder that defenders can’t rely on passwords alone anymore. By combining MFA, token monitoring, and staff awareness, small teams can close the door on token-based phishing attacks and keep Microsoft 365 safer. Start with the quick MFA enablement and then layer in phishing-resistant authentication as a next step.
If you’re dealing with a suspected breach or want a quick security check, consider scheduling a quick review of sign-in reports and token usage patterns this week.