FBI warns of Kali Oauth stealers

Key Points:

• New phishing attacks utilizing the Kali365 tool are enabling cyber criminals to steal Microsoft 365 access tokens and bypass multi-factor authentication (MFA) without credential interception.
• The attack impacts Microsoft 365 accounts, allowing unauthorized access through captured Oauth tokens, posing significant risks to organizational security.
• Recommended actions include implementing conditional access policies to block code flow for all users and restricting authentication transfer policies to prevent unauthorized access from mobile devices.

Technical Details: Kali365 captures Oauth tokens linked to victims' Microsoft 365 accounts by tricking users into authorizing attackers' devices through phishing emails that appear legitimate.

MITRE ATT&CK Techniques:

• T1566.001 - Phishing: Spearphishing Link (Initial Access)
• T1078 - Valid Accounts (Defense Evasion)

IOCs Mentioned: None mentioned