Kali365: A New Microsoft 365 Phishing Threat Businesses Need to Take Seriously

Cybercriminals are getting smarter, and the old advice of “just don’t click suspicious links” is no longer enough.

A newer phishing threat called Kali365 is targeting Microsoft 365 users in a way that can bypass normal password and MFA protections. For small businesses, dental offices, healthcare practices, and professional offices, this is something that should be taken seriously.

Microsoft 365 is where many businesses run their daily operations. Email, Teams, OneDrive, SharePoint, calendars, files, vendor communication, insurance documents, and internal conversations often live inside one Microsoft account.

If that account gets compromised, the damage can spread quickly.

What Is Kali365?

Kali365 is a Phishing-as-a-Service platform. That means cybercriminals can use it as a ready-made phishing toolkit instead of building their own attack from scratch.

According to the FBI’s Internet Crime Complaint Center, Kali365 has been used to target Microsoft 365 accounts by stealing OAuth access tokens. These tokens can allow attackers to access a user’s Microsoft 365 account without needing the user’s password again.

That is what makes this threat dangerous.

Many businesses assume that if they have MFA turned on, they are fully protected. MFA is still very important, but Kali365 shows why MFA alone is not enough. Attackers are no longer only trying to steal passwords. They are trying to steal access.

How the Kali365 Attack Works

A Kali365-style phishing attack may start with an email that looks like it came from a trusted service. It may look like a Microsoft alert, a shared document, a cloud file request, or a message from a business productivity tool.

Instead of sending the user to a fake login page, the attacker may tell the user to visit a real Microsoft verification page and enter a device code.

That is what makes the attack so convincing.

The page may actually be Microsoft’s real page, so the employee may think it is safe. But when the user enters the code, they may unknowingly authorize the attacker’s device to access their Microsoft 365 account.

Once that happens, the attacker may capture access and refresh tokens. Those tokens can allow the attacker to access Microsoft 365 services such as Outlook, Teams, and OneDrive without needing the user’s password or another MFA approval.

In simple terms:

• The user thinks they are completing a normal Microsoft sign-in.

• The attacker is actually getting access to the account.

Why This Matters for Dental Offices and Small Businesses

For a dental office or small business, Microsoft 365 is not just email.

It may include:

1. Patient or client communication

2. Appointment-related messages

3. Billing discussions

4. Insurance documents

5. Vendor communication

6. HR files

7. Internal business documents

8. OneDrive and SharePoint files

9. Teams conversations

10. If an attacker gets into one Microsoft 365 account, they may be able to read emails, send emails as that person, access shared files, create forwarding rules, impersonate the office manager, or attempt payment fraud.

11. For dental and healthcare-related offices, there is also a compliance concern. If patient-related information is exposed, the situation may involve HIPAA-related responsibilities.

This is why account security needs to be treated as a business priority, not just an IT issue.

How to Prevent Kali365 Attacks

The best way to protect your business is to reduce the chance that an employee can unknowingly authorize an attacker’s device.

Here are the key steps businesses should take.

1. Block or Restrict Device Code Flow

Kali365 abuses a Microsoft authentication method called device code flow.

Device code flow is used when someone signs into an app or device that may not have a normal browser login experience. In some cases, it is legitimate. But for many businesses, regular users do not need it.

Your IT provider should review whether device code flow is being used in your Microsoft 365 environment. If it is not needed, it should be blocked through Microsoft Entra Conditional Access policies.

If it is needed for certain devices, it should be limited only to approved accounts or approved business use cases.

2. Use Conditional Access Policies

Conditional Access is one of the most important security features for Microsoft 365.

It allows you to control who can access your Microsoft 365 environment, from where, on what device, and under what conditions.

1. For example, Conditional Access can help:

2. Block risky authentication methods

3. Require MFA for certain users

4. Block sign-ins from unusual locations

5. Require trusted or compliant devices

6. Protect administrator accounts

7. Restrict access from unmanaged devices

8. Limit access based on risk level

Without Conditional Access, your Microsoft 365 environment may be easier to attack.

3. Strengthen MFA

MFA is still important, but it needs to be configured properly.

Businesses should avoid weak or outdated authentication methods where possible. Stronger options such as number matching, phishing-resistant MFA, or hardware security keys should be considered, especially for administrators and high-risk accounts.

Employees should also be trained not to approve unexpected MFA prompts and not to enter device codes unless they personally started the login process.

A good rule for staff is:

Never enter a Microsoft device code unless you know exactly what device or application you are signing into.

4. Train Employees on Modern Phishing

Employees need to understand that not all phishing attacks look fake.

Some attacks use real Microsoft pages. Some attacks use QR codes. Some attacks use device codes. Some attacks may look like a shared document or a normal business request.

Training should teach employees to slow down and ask:

1. Was I expecting this email?

2. Do I know the sender?

3. Is this asking me to enter a code?

4. Is this asking me to approve a login?

5. Is this message creating urgency?

6. Does this request feel unusual?

If the answer feels suspicious, the employee should report it before taking action.

5. Monitor Microsoft 365 Sign-In Logs

Security should not depend only on users reporting suspicious emails.

Microsoft 365 sign-in logs should be reviewed for unusual activity, including:

1. Device code flow sign-ins

2. Logins from unfamiliar countries or cities

3. Successful sign-ins from unknown devices

4. Sign-ins outside normal work hours

5. Repeated failed login attempts

6. Impossible travel alerts

7. Suspicious application access

8. Unusual file access or sharing

Monitoring helps catch problems faster before they turn into bigger incidents.

6. Review App Permissions

Attackers may try to gain long-term access through app permissions or OAuth consent.

Your Microsoft 365 environment should be reviewed for apps that have access to email, files, calendars, or user data. Any unknown or unnecessary app permissions should be removed.

Users should not be allowed to approve risky third-party app permissions without administrator review.

7. Protect Administrator Accounts

Admin accounts need stronger protection than regular user accounts.

Administrator accounts should use strong MFA, dedicated admin-only accounts, limited permissions, and Conditional Access restrictions.

Admin accounts should not be used for daily email, browsing, or routine work.

If an attacker compromises an admin account, the damage can be much more serious.

How Can You Tell if a Microsoft 365 Account Is Compromised?

A compromised account is not always obvious. Sometimes the user can still log in normally while the attacker is also inside the account.

Here are common warning signs:

1. Emails sent that the user did not write

2. Customers or vendors receiving strange messages

3. Unexpected MFA prompts

4. Sign-ins from unfamiliar locations

5. Successful device code flow sign-ins

6. Unknown devices connected to the account

7. New inbox rules created without approval

8. Email forwarding to an outside address

9. Emails being deleted or moved automatically

10. OneDrive or SharePoint files shared unexpectedly

11. Teams messages sent by the user that they did not send

12. Password reset emails the user did not request

13. Security information changed on the account

14. Unknown authenticator apps or phone numbers added

15. Suspicious apps granted access to Microsoft 365

16. Unusual activity outside normal business hours

If you see any of these signs, treat the account as potentially compromised.

What Should Be Done if an Account Is Compromised?

If a Microsoft 365 account is compromised, do not only change the password and assume the problem is fixed.

With token-based attacks, the attacker may still have access through active sessions or refresh tokens. A proper response should include containment, cleanup, investigation, and prevention.

Here is what should be done.

1. Disable the Account Temporarily

The affected account should be disabled while the investigation begins.

This helps stop the attacker from continuing to access the account while IT reviews what happened.

2. Revoke Sessions and Refresh Tokens

This is a critical step.

If an attacker stole access or refresh tokens, changing the password may not immediately remove their access. Active sessions and refresh tokens should be revoked so the attacker is forced out.

The user should be signed out of all sessions across Microsoft 365.

3. Reset the Password

The user’s password should be reset to a strong, unique password.

The new password should not be similar to the old one, and it should not be reused anywhere else.

4. Review MFA Methods

The user’s MFA methods should be reviewed.

Remove anything suspicious, including unknown phone numbers, unknown authenticator apps, alternate emails, or security methods the user does not recognize.

Then re-register MFA using trusted methods.

5. Review Sign-In Logs

Microsoft Entra sign-in logs should be checked to understand how the attacker got in and what they accessed.

Look for:

• Device code flow activity

• Unknown IP addresses

• Unknown locations

• Suspicious apps

• Successful logins outside normal hours

• Logins from unfamiliar devices

• Repeated failed attempts before a successful login

This helps determine the scope of the incident.

6. Remove Unknown Devices

Check the user’s registered devices and active sessions.

Any device that is not recognized should be removed or disabled.

7. Check Mailbox Rules and Forwarding

Attackers often create mailbox rules to hide their activity.

Check for rules that:

• Forward emails externally

• Delete incoming messages

• Move emails to hidden folders

• Mark emails as read

• Hide replies from customers or vendors

Any suspicious rules should be removed immediately.

8. Review Sent Mail, Deleted Mail, and Recoverable Items

Check the user’s sent items, deleted items, and recoverable deleted items.

This can help determine whether the attacker sent phishing emails, payment fraud messages, vendor requests, or sensitive information outside the organization.

9. Review OneDrive, SharePoint, and Teams

The investigation should include more than email.

Check whether files were accessed, downloaded, deleted, or shared. Review Teams activity to see whether messages were sent from the compromised account.

If sensitive information was accessed, additional compliance or notification steps may be required.

10. Review OAuth App Permissions

Check whether any suspicious apps were granted access to the account.

Remove any app permissions that are not approved or clearly tied to a legitimate business need.

11. Notify the Right People

Depending on the situation, the business may need to notify leadership, IT support, cyber insurance, legal counsel, vendors, or affected clients.

For dental and healthcare offices, this step is especially important if patient-related information may have been exposed.

12. Report the Incident

If your business was impacted by Kali365 or a similar phishing attack, the incident should be reported to the FBI’s Internet Crime Complaint Center.

Useful information to preserve includes:

• The phishing email

• Email headers

• Time of suspicious logins

• IP addresses

• Locations

• Unauthorized devices

• Active sessions

• Screenshots of suspicious activity

• Any fraudulent emails sent from the account

The more information you preserve, the easier it is to investigate the incident.

The Main Lesson for Business Owners

Kali365 is a reminder that cybersecurity is no longer just about passwords.

Attackers are targeting trusted login flows, access tokens, Microsoft 365 permissions, and employee habits. That means businesses need more than basic antivirus and MFA.

A strong Microsoft 365 security plan should include:

• Conditional Access

• MFA hardening

• Device code flow restrictions

• Sign-in monitoring

• App permission reviews

• Account compromise response steps

• Email security protection

• Backup and recovery planning

• Employee phishing training

For small businesses and dental offices, the goal is not to make technology complicated. The goal is to make sure one mistaken click does not lead to downtime, data exposure, fraud, or compliance problems.

How AEGIX Technologies Can Help

At AEGIX Technologies, we help businesses protect their Microsoft 365 environment before a small mistake turns into a serious security incident.

We can help with:

• Microsoft 365 security reviews

• Conditional Access setup

• MFA and identity protection

• Device code flow restrictions

• Email security improvements

• Sign-in monitoring

• Backup and disaster recovery planning

• HIPAA-aware IT support

• Security awareness training

• Incident response guidance

• Vendor coordination

If your business uses Microsoft 365 and you are not sure whether your accounts are properly protected, now is the time to review your security.

Cybersecurity is not just about stopping attacks. It is about keeping your business running, protecting sensitive data, and giving your team confidence that the right safeguards are in place.

If you are unsure whether your Microsoft 365 environment is secure, AEGIX Technologies can help you find the gaps before attackers do.