{"id":115593,"date":"2026-06-16T20:27:08","date_gmt":"2026-06-16T15:27:08","guid":{"rendered":"https:\/\/dailyausaf.com\/en\/?p=115593"},"modified":"2026-06-16T20:27:08","modified_gmt":"2026-06-16T15:27:08","slug":"scam-alert-fbi-issues-warning-for-teams-outlook-onedrive-users","status":"publish","type":"post","link":"https:\/\/dailyausaf.com\/en\/technology\/scam-alert-fbi-issues-warning-for-teams-outlook-onedrive-users\/","title":{"rendered":"Scam Alert: FBI issues warning for Teams, Outlook, OneDrive users"},"content":{"rendered":"
A <\/span>new <\/span>Microsoft <\/span>365 <\/span>scam <\/span>on <\/span>Microsoft <\/span>Teams, <\/span>Outlook, <\/span>and <\/span>OneDrive <\/span>is <\/span>spreading <\/span>quickly, <\/span>and <\/span>the <\/span>FBI <\/span>is <\/span>warning <\/span>the <\/span>public <\/span>about <\/span>it.<\/span><\/span><\/div>\n
<\/div>\n
The <\/span>FBI <\/span>noted <\/span>that <\/span>a <\/span>hacking <\/span>platform <\/span>called <\/span>Kali365 <\/span>is <\/span>being <\/span>used <\/span>to <\/span>steal <\/span>OAuth <\/span>device <\/span>codes <\/span>from <\/span>its <\/span>victims, <\/span>which <\/span>grants <\/span>attackers <\/span>full <\/span>access <\/span>to <\/span>Microsoft <\/span>accounts <\/span><\/a>without <\/span>requiring <\/span>the <\/span>username <\/span>or <\/span>password. <\/span><\/span>Additionally, <\/span>no <\/span>multifactor <\/span>authentication <\/span>code <\/span>is <\/span>intercepted.<\/span><\/span><\/div>\n

How <\/span>the <\/span>Scam <\/span>works<\/span><\/span><\/h2>\n
As <\/span>outlined <\/span>by <\/span>the <\/span>FBI, <\/span>attackers <\/span>send <\/span>a <\/span>phishing <\/span>email <\/span>that <\/span>mimics <\/span>a <\/span>trusted <\/span>cloud <\/span>document-sharing <\/span>or <\/span>cloud <\/span>productivity <\/span>service. <\/span><\/span>A <\/span>device <\/span>code <\/span>is <\/span>included <\/span>within <\/span>the <\/span>phishing <\/span>message, <\/span>and <\/span>its <\/span>recipient <\/span>is <\/span>prompted <\/span>to <\/span>input <\/span>it <\/span>at <\/span>a <\/span>Microsoft <\/span>verification <\/span>website <\/span>to <\/span>log <\/span>in. <\/span><\/span><\/div>\n
<\/div>\n
Once <\/span>the <\/span>user <\/span>enters <\/span>the <\/span>device <\/span>code <\/span>on <\/span>the <\/span>malicious <\/span>page, <\/span>they <\/span>unintentionally <\/span>authorize <\/span>the <\/span>attacker\u2019s <\/span>device <\/span>to <\/span>access <\/span>their <\/span>Microsoft <\/span>365 <\/span>account.<\/span><\/span><\/div>\n
<\/div>\n
Attackers <\/span>can <\/span>then <\/span>steal <\/span>both <\/span>OAuth <\/span>access <\/span>and <\/span>refresh <\/span>tokens <\/span>in <\/span>order <\/span>to <\/span>carry <\/span>out <\/span>a <\/span>full <\/span>Microsoft <\/span>365 <\/span>account <\/span>takeover <\/span>for <\/span>Outlook, <\/span>Teams, <\/span>or <\/span>OneDrive <\/span>services. <\/span><\/span><\/div>\n
<\/div>\n
Kali365, <\/span>the <\/span>platform <\/span>being <\/span>used, <\/span>is <\/span>described <\/span>by <\/span>the <\/span>FBI <\/span>as <\/span>a <\/span>nascent <\/span>Phishing-as-a-Service <\/span>tool <\/span>that <\/span>offers <\/span>criminals <\/span>with <\/span>weak <\/span>technical <\/span>skills <\/span>a <\/span>variety <\/span>of <\/span>features, <\/span>including <\/span>AI-driven <\/span>phishing <\/span>lures, <\/span>automated <\/span>campaign <\/span>templates, <\/span>real-time <\/span>tracking <\/span>dashboards, <\/span>and <\/span>OAuth <\/span>token <\/span>capture <\/span>functionality. <\/span><\/span><\/div>\n
<\/div>\n
The <\/span>FBI <\/span>detected <\/span>Kali365 <\/span>in <\/span>April <\/span>and <\/span>reported <\/span>it’s <\/span>being <\/span>sold <\/span>for <\/span>$250 <\/span>monthly. <\/span><\/span>The <\/span>crime <\/span>is <\/span>considered <\/span>concerning <\/span>because <\/span>the <\/span>technique <\/span>doesn’t <\/span>rely <\/span>on <\/span>phishing <\/span>credentials <\/span>but <\/span>rather <\/span>on <\/span>abusing <\/span>the <\/span>device-code <\/span>authorization <\/span>method.<\/span><\/span><\/div>\n
<\/div>\n
The <\/span>scam <\/span>bypasses <\/span>multifactor <\/span>authentication <\/span>when <\/span>the <\/span>user <\/span>follows <\/span>the <\/span>phishing <\/span>lure’s <\/span>instructions, <\/span>and <\/span>their <\/span>access <\/span>tokens <\/span>are <\/span>captured.<\/span><\/span><\/div>\n

What <\/span>to <\/span>do <\/span>if <\/span>You <\/span>Are <\/span>Targeted <\/span>by <\/span>this <\/span>Attack<\/span><\/span><\/h2>\n
The <\/span>FBI <\/span>cautions <\/span>individuals <\/span>not <\/span>to <\/span>open <\/span>emails <\/span>with <\/span>unsolicited <\/span>instructions <\/span>or <\/span>links <\/span>that <\/span>prompt <\/span>users <\/span>to <\/span>enter <\/span>access <\/span>codes. <\/span><\/span>All <\/span>phishing <\/span>emails, <\/span>suspicious <\/span>logins, <\/span>new <\/span>and <\/span>unexpected <\/span>devices, <\/span>and <\/span>sessions <\/span>that <\/span>have <\/span>been <\/span>added <\/span>to <\/span>accounts <\/span>should <\/span>be <\/span>reported <\/span>to <\/span>the <\/span>Internet <\/span>Crime <\/span>Complaint <\/span>Center. <\/span><\/span><\/div>\n
<\/div>\n
Users <\/span>are <\/span>advised <\/span>to <\/span>provide <\/span>as <\/span>many <\/span>details <\/span>as <\/span>possible <\/span>in <\/span>their <\/span>report, <\/span>such <\/span>as <\/span>email <\/span>headers, <\/span>messages, <\/span>the <\/span>IP <\/span>addresses <\/span>of <\/span>logins,<\/span>\u00a0<\/span>login <\/span>locations, <\/span>and <\/span>times.<\/span><\/span><\/div>\n
<\/div>\n
Microsoft <\/span>recommends <\/span>following <\/span>the <\/span>FBI’s <\/span>warnings <\/span>and <\/span>mentions <\/span>in <\/span>its <\/span>statements <\/span>that <\/span>its <\/span>Digital <\/span>Crimes <\/span>Unit <\/span>has <\/span>recently <\/span>disrupted <\/span>other <\/span>phishing <\/span>tools <\/span>like <\/span>RaccoonO365 <\/span>and <\/span>other <\/span>do-it-yourself <\/span>phishing <\/span>attacks <\/span>that <\/span>were <\/span>designed to steal<\/span>\u00a0<\/span>users’ <\/span>passwords <\/span>and <\/span>data. <\/span><\/span>Microsoft <\/span>says <\/span>it’s <\/span>continuously <\/span>working <\/span>to <\/span>disrupt <\/span>account <\/span>takeover <\/span>and <\/span>phishing-as-a-service <\/span>networks.<\/span><\/span><\/div>\n","protected":false},"excerpt":{"rendered":"

A new Microsoft 365 scam on Microsoft Teams, Outlook, and OneDrive is spreading quickly, and the FBI is warning the public about it. The FBI noted that a hacking platform called Kali365 is being used to steal OAuth device codes from its victims, which grants attackers full access to Microsoft accounts without requiring the username […]<\/p>\n","protected":false},"author":9,"featured_media":79942,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,8],"tags":[30338],"class_list":["post-115593","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-latest-news","category-technology","tag-scam-alert"],"_links":{"self":[{"href":"https:\/\/dailyausaf.com\/en\/wp-json\/wp\/v2\/posts\/115593","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dailyausaf.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dailyausaf.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dailyausaf.com\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/dailyausaf.com\/en\/wp-json\/wp\/v2\/comments?post=115593"}],"version-history":[{"count":2,"href":"https:\/\/dailyausaf.com\/en\/wp-json\/wp\/v2\/posts\/115593\/revisions"}],"predecessor-version":[{"id":115600,"href":"https:\/\/dailyausaf.com\/en\/wp-json\/wp\/v2\/posts\/115593\/revisions\/115600"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dailyausaf.com\/en\/wp-json\/wp\/v2\/media\/79942"}],"wp:attachment":[{"href":"https:\/\/dailyausaf.com\/en\/wp-json\/wp\/v2\/media?parent=115593"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dailyausaf.com\/en\/wp-json\/wp\/v2\/categories?post=115593"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dailyausaf.com\/en\/wp-json\/wp\/v2\/tags?post=115593"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}