Tag

device-code-phishing

Safeguard articles tagged "device-code-phishing" — guides, analysis, and best practices for software supply chain and application security.

1 article

Identity Security

FBI Warns on Kali365: A PhaaS Kit That Steals M365 OAuth Tokens and Bypasses MFA (May 2026)

The FBI's May 21, 2026 IC3 advisory details Kali365, a Telegram-distributed phishing-as-a-service kit that uses device-code phishing to capture Microsoft 365 access and refresh tokens, granting password-free, MFA-immune persistence.

May 22, 202611 min read