The Context: Direct Hacking Is No Longer Required
Threat actors targeting Microsoft 365 and Azure have largely shifted away from malware and credential stuffing. The current playbook is more straightforward: abuse a legitimate Microsoft capability, pair it with a social engineering lure, and blend into routine IT activity until the damage is complete.
Two campaigns documented in May 2026 clearly demonstrate this approach. The FBI issued a warning about Kali365, a Phishing-as-a-Service platform that steals OAuth tokens and provides persistent M365 access without requesting a password. Microsoft described how Storm-2949 used a fake IT support call and a single MFA approval to move laterally across an entire Azure environment.
💡 Neither attack depended on a software vulnerability. Both began when a user made a decision that appeared reasonable but was based on false pretenses.
Ongoing Attacks
Kali365: A Phishing Kit That Steals M365 Access Without a Password
Kali365 is a PhaaS platform distributed through Telegram since April 2026. It provides low-skill threat actors with everything needed to run an MFA-bypass campaign: AI-generated lures, automated templates, tracking dashboards, and OAuth token capture. Technical expertise is not required.
Kill chain:
- A phishing email impersonates a trusted cloud service and instructs the recipient to enter a device code on a legitimate Microsoft page.
- The victim opens a genuine Microsoft URL and pastes in the code. This unknowingly authorizes the threat actor’s device.
- Kali365 captures the resulting OAuth access tokens and refresh tokens.
- The threat actor obtains persistent access to Outlook, Teams, and OneDrive. No password is required, and no additional MFA approval is needed.
Microsoft’s device code flow is a legitimate feature designed for devices that cannot display a sign-in page. Kali365 misuses this feature against ordinary enterprise users. Because the victim completes the action on a real Microsoft page, standard MFA has already been satisfied before the token is collected.
Storm-2949: One Phone Call, One MFA Approval, One Full Azure Breach
Storm-2949 is a financially motivated threat actor that turned a single social engineering interaction into large-scale Azure data exfiltration. The operation did not require deploying any malware.
Kill chain:
- A threat actor impersonates an internal IT helpdesk representative and contacts a targeted user, such as IT staff or senior leadership.
- The user is persuaded to approve an MFA prompt as part of a “routine password reset.”
- The threat actor uses Microsoft SSPR to reset the account password, remove the user’s authentication methods, and register their own device. This locks out the legitimate user.
- The same process is repeated on three additional accounts with privileged Azure RBAC roles.
- With those identities, the threat actor can move freely. The activity includes bulk downloads from OneDrive and SharePoint, extraction of secrets from Azure Key Vault, access to SQL databases, exfiltration from Storage accounts, and installation of ScreenConnect on virtual machines for persistent remote access.
The entire operation resembled normal administrative activity. Detection required simultaneous correlation of signals across identity systems, M365, and Azure. The social engineering call was the only vulnerability that ultimately mattered. Everything else followed from one user approving a single MFA prompt they had not initiated.
Additional context on how threat actors abuse MFA and identity systems you can find on this link.
Action-Oriented Prevention
Can users recognize these attacks?
That is the first question to address. Both attacks begin with social engineering, either a phishing email or a fake IT support call. Technical controls cannot stop a user who genuinely believes they are helping IT reset their account. Phishing simulations that include device code lure scenarios train employees to pause before pasting a code into any site, regardless of how legitimate it appears.
Is MFA enough?
Not for these attacks. Standard push-based MFA is completed as part of the Kali365 token theft flow, while Storm-2949 deceives users into approving prompts themselves. Phishing-resistant MFA, such as FIDO2 keys or passkeys, closes this gap. It is bound to the domain and cannot be replayed by a threat actor holding a captured token.
Is SSPR a liability in the environment?
Yes, if accounts can trigger a reset without a pre-registered MFA method. Existing MFA registration should be required before SSPR can be initiated. This blocks the Storm-2949 entry vector.
Are Azure permissions scoped correctly?
Storm-2949’s blast radius, from one account to Key Vaults, SQL, Storage, and VMs, was directly enabled by over-permissioned RBAC roles. Custom Azure RBAC assignments should be audited, least privilege should be applied, and high-risk operations should be restricted. These include publishing profile retrieval, VM extension deployment, and Run Command. Access to these operations should be limited to accounts that genuinely require it.
Are the right signals being monitored?
A new MFA device registration immediately after a password reset is a high-confidence indicator of compromise. Mass file downloads across multiple OneDrive accounts within a short time window are another indicator. Correlating SSPR events, authentication anomalies, and cloud resource access in one view helps detect these campaigns before they spread. Threat monitoring provides security teams with that cross-domain visibility.
Has device code flow been blocked?
If it has not been blocked, this control should be implemented. A Conditional Access policy should be created to block device authentication codes for all users, with tightly scoped exceptions only for processes that require them. This is the most direct mitigation for attacks similar to Kali365.
Assessing Team Resilience Against Social Engineering
Both attacks in this article began in the same way: a user made a decision that the threat actor needed them to make. The most direct way to reduce this risk is to test and train users before a real threat actor does. To get a demo of the Arsen solution for training users to counter phishing, vishing, and smishing, please leave your contact details in the form below.
