Kali365 and the OAuth Device Code Phishing Wave

A Telegram-distributed phishing kit is bypassing MFA on Microsoft 365 with the OAuth device code flow. Here is how I detect and block it.

September 12, 2026 · 4 min · Caleb