AI-powered phishing kits spark 1,380% surge in Microsoft 365 attacks, forcing rethink of identity security

By early 2026, Kali365 emerged as a sophisticated phishing-as-a-service platform that exploited the OAuth device code authentication flow—originally designed for non-interactive devices like smart TVs and printers—to bypass Microsoft 365's multifactor authentication (MFA). Despite victims completing MFA prompts normally, attackers captured live OAuth tokens, granting full account access without needing user passwords, a technique that alarmed security experts and prompted the FBI to issue a public warning in May 2026.

The FBI's alert underscored the rapid proliferation of Kali365 attacks, which by April 2026 had already targeted hundreds of organizations across diverse sectors including manufacturing, healthcare, education, government, and financial services. This surge in attacks, facilitated by a $250 phishing kit that automated token theft via AI-generated lures and real-time victim dashboards, highlighted a troubling democratization of advanced OAuth abuse techniques, prompting renewed FBI advisories and calls for organizations to restrict or disable device code authentication flows through Microsoft Entra conditional access policies where feasible.

By early 2026, device-code phishing attacks surged by an astonishing 1,380%, a spike largely fueled by the rise of phishing-as-a-service platforms that automate entire attack workflows. Huntress researchers highlighted that these platforms combine generative AI with automated processes to industrialize phishing, enabling even novices to launch complex campaigns without deep technical knowledge. This democratization is underscored by Huntress CEO Kyle Hanslovan's observation that 'you just don't have to know this,' opening the floodgates for widespread identity theft.

Platforms like Kali365 exemplify this automation-driven democratization by offering subscription-based access to sophisticated phishing tools for as little as $250 per month. According to FBI reports, Kali365 automates device-code phishing workflows with AI-generated lures, real-time tracking dashboards, and OAuth token capture capabilities, drastically lowering the barrier to entry for less-technical attackers. The platform's ease of use and subscription model have fueled hundreds of attacks within its first month of detection in April 2026, illustrating how automation accelerates the scale and effectiveness of these campaigns.

Emerging kits like Jalisco further push the envelope by automating real-time generation of fresh Microsoft OAuth device codes, effectively bypassing Microsoft's 15-minute device code validity window. Alongside EvilTokens, Kali365, and others, Jalisco provides user-friendly web portals for managing compromised accounts, enabling attackers to exfiltrate data within minutes—sometimes as fast as six minutes—before defenders can react. This seamless automation and intuitive interface not only expedite account takeovers but also contribute significantly to the democratization of sophisticated device-code phishing attacks across the cybercriminal landscape.

By early 2026, the phishing landscape targeting Microsoft 365 witnessed a dramatic transformation with the emergence of sophisticated kits like EvilTokens and its affiliate ARToken, which Cisco Talos identified as a fully-fledged business email compromise (BEC) platform. EvilTokens alone saw a staggering 1,380% surge in phishing attacks compared to the previous year, fueled by AI integration that automated and personalized attacks, enabling large-scale exploitation of OAuth device code flows to bypass MFA entirely.

ARToken distinguishes itself from typical phishing kits through its comprehensive post-compromise toolkit and advanced evasion techniques, including a seven-layer anti-analysis system that combines client-side behavioral verification with XOR-encrypted payloads. This platform offers full Microsoft Outlook inbox access, allowing attackers to manipulate inbox rules, send emails as victims, and monitor keywords, effectively creating a mature BEC-as-a-service environment that facilitates persistent and stealthy account control.

The social engineering tactics employed by ARToken are notably sophisticated, leveraging real vendor relationships and legitimate domain look-alikes to craft highly targeted phishing lures. For instance, Cisco Talos recovered emails spoofing an accounts-payable contact from a genuine Wisconsin contractor to a U.S. life sciences company, abusing authentic business ties and using reply-pivot techniques with SharePoint-hosted payloads to evade detection and increase the likelihood of successful compromise.

Cisco Talos experts, including Michael Kelley, highlight that ARToken represents a significant evolution in phishing kits, being more polished and fleshed out than previous offerings. This shift signals the maturation of phishing-as-a-service platforms into comprehensive BEC ecosystems that not only automate token theft but also provide affiliates with sophisticated operational tools and infrastructure, as evidenced by EvilTokens’ vast network of over 1,000 phishing pages and 500 Cloudflare Workers domains targeting finance, HR, and logistics professionals worldwide.

Attackers are increasingly exploiting legitimate remote access tools such as LogMeIn, ScreenConnect, and AnyDesk to blend malicious activity with routine IT operations, significantly complicating detection efforts. HP Wolf Security’s 2026 Threat Insights Report highlights that these attacks mimic normal user or administrator behavior, effectively camouflaging themselves within trusted software environments. As Alex Holland from HP Security Lab explains, "These attacks don't look like break-ins - they look like business as usual," underscoring the challenge conventional detection methods face in distinguishing malicious actions from legitimate administrative tasks.

The rise of AI-assisted social engineering campaigns has amplified the sophistication and scale of identity-based attacks, with threat actors deploying convincing phishing lures such as fake crypto wallet recovery tools and malware disguised as benign media files. HP researchers observed 'vibe coding'—scripts laden with emojis—indicating semi-automated assembly of attack components, which, combined with plausible narratives distributed via popular code-sharing and media platforms, increases victim engagement and complicates defensive postures. This evolution demands that organizations move beyond traditional perimeter defenses to embrace identity-centric security frameworks that emphasize continuous verification and behavioral analysis.

The persistent threat landscape, exemplified by large-scale credential theft campaigns like the FortiBleed attacks targeting Fortinet, Sophos, and MSSQL devices, reveals a multi-stage adversary approach leveraging password spraying, configuration extraction, and offline cracking to gain high-privilege access. Palo Alto Networks and Unit 42 emphasize that mitigating such threats requires robust identity-centric strategies including mandatory multi-factor authentication, Zero Trust Architecture, Privileged Access Management, and automated Identity Threat Detection and Response (ITDR). Continuous monitoring of remote access logs—especially for suspicious logins following mass password failures—is critical to timely detection and response.

As the traditional network perimeter dissolves into a complex ecosystem of authentication flows, AI agents, and interconnected enterprise applications, cybersecurity must pivot to treating identity as the new perimeter. Analysts note that attackers exploit trusted platforms faster than organizations can adapt, while AI-generated deepfakes and zero-click vulnerabilities in AI-powered development environments further complicate trust verification. Experts argue that security technologies must better align with human behavior—embedding authenticity verification features and supporting users rather than expecting behavioral change—to build lasting trust and transform cybersecurity from a cost center into a business enabler.