The FBI has warned about a phishing tool called Kali365 that can bypass two-factor authentication on Microsoft 365 accounts.

A phishing kit subverting Microsoft’s legitimate authentication flow lets attackers break into accounts without stealing ...

A surge in phishing campaigns abusing Microsoft’s OAuth device code authorization flow has been observed with multiple threat clusters using the technique to gain unauthorized access to Microsoft 365 ...