FBI says Microsoft Outlook and OneDrive users face growing cyber threat

The FBI has issued an urgent warning to users of Microsoft 365 services, including Microsoft Teams, Outlook and OneDrive, over a growing phishing campaign that can bypass multi-factor authentication.

According to the agency, cybercriminals are using a hacking platform known as Kali365 to steal OAuth authentication tokens, allowing attackers to gain access to accounts without needing passwords.

The phishing operation reportedly targets Microsoft users through emails designed to appear legitimate.

Victims are asked to enter a device verification code on an official Microsoft page. Once entered, attackers can capture the access token and gain entry to accounts linked to Outlook, Teams and OneDrive.

The FBI warned that “Kali365 lowers the barrier of entry, providing less-technical attackers access to AI-generated phishing lures, automated campaign templates, real-time targeted individual/entity tracking dashboards, and OAuth token capture capabilities”.

Cybersecurity researchers say the platform has been actively promoted through Telegram channels since April 2026. Reports cited by Fastcompany.com said access to the service costs around $250 per month.

The FBI has advised users not to open links or enter access codes they did not request and urged victims to report incidents to the Internet Crime Complaint Center.