05/22/2026
This is a real threat. Most small business owners hope they’re protected. Ours know they are.
Today the FBI released a warning the public about Kali365—an emerging Phishing-as-a-Service (PhaaS) platform. Kali365, first seen in April 2026, enables cyber threat actors to obtain Microsoft 365 access tokens and bypass multi-factor authentication (MFA) protocols without intercepting the user’s credentials. The platform allows less-skilled attackers access to AI-generated phishing lures, automated campaign templates, real-time targeted individual/entity tracking dashboards, and OAuth token capture capabilities.
Learn more about how the scam works and review recommendations on how to protect yourself: ic3.gov/PSA/2026/PSA260521