The FBI has warned users about a new AI powered phishing scam targeting Microsoft 365 accounts.
Credit : Dikushin Dmitry, Shutterstock
A lot of people still feel relatively safe once they activate two factor authentication on their accounts.
The logic seems simple. Even if somebody steals the password, they still need the verification code too. But cybersecurity experts are now warning that things no longer work that neatly.
The FBI has issued a warning about a growing phishing scam targeting Microsoft 365 users that can give attackers access to accounts without victims directly handing over their passwords at all.
And honestly, that is exactly why the scam is making people nervous. Because many victims do not realise they are being hacked while it is happening.
The threat is known as Kali365, a phishing platform that security researchers say is specifically designed to target Microsoft accounts by tricking users into authorising access themselves.
Once that happens, hackers may remain connected to emails, cloud files and company systems for long periods without repeatedly asking for passwords or verification codes again.
According to the FBI, the scam is becoming especially concerning because artificial intelligence is now helping cybercriminals create far more convincing fake emails and phishing campaigns than before.
Messages look cleaner. The wording sounds more natural. And the usual obvious warning signs people once relied on are becoming much harder to spot.
Why this scam feels more dangerous than older phishing emails
Most people already know the classic phishing scenario.
You receive an email pretending to be from a bank or online platform. It asks you to log in urgently. You type your password into a fake page and the scammer steals your credentials.
Kali365 works differently and that difference matters.
Instead of focusing mainly on passwords, the scam targets something most ordinary users have never even heard of before.
Login session tokens. These tokens are what allow people to stay logged into services like Outlook, Teams or OneDrive without constantly entering passwords again throughout the day.
Basically, they quietly keep the session active in the background. Cybercriminals have realised stealing those tokens can sometimes be even more useful than stealing passwords directly.
According to the FBI warning, attackers using Kali365 typically send emails pretending to come from productivity tools or document sharing services linked to Microsoft 365.
Victims are then asked to verify a device code through what appears to be a legitimate Microsoft page. And this is where the trap becomes clever.
Because technically, the page itself may actually belong to Microsoft. That makes the process feel trustworthy. But what users are unknowingly doing is approving access for the attacker’s device instead of their own.
Once the request is accepted, the attacker can potentially access emails, cloud documents and connected Microsoft services while appearing like a legitimate authenticated user. And because the system relies on approved session access rather than repeated password requests, the intrusion may remain unnoticed for much longer.
AI is making phishing scams look far more believable
One reason security agencies are becoming increasingly worried is the role artificial intelligence now plays in modern phishing attacks.
Years ago, scam emails often looked ridiculous: Bad grammar, weird formatting, random capital letters and messages translated badly into English.
A lot of people could recognise them immediately. That is changing very quickly.
AI tools now allow scammers to generate polished emails that sound natural and professional in multiple languages within seconds.
And that is lowering people’s guard. Because many users still expect phishing attempts to feel obviously suspicious.
Now some fake emails look almost identical to real workplace notifications.
The FBI says platforms like Kali365 also give attackers access to automated phishing templates, campaign management systems and tracking dashboards showing which victims have interacted with messages.
In simple terms, cybercrime is becoming easier to organise and far more scalable. And experts say that means ordinary users are increasingly becoming targets too, not only large corporations.
Microsoft 365 accounts are particularly attractive because they often contain years of emails, financial information, cloud storage, work documents and sensitive conversations all connected inside the same ecosystem.
For cybercriminals, gaining access to one account can sometimes open the door to much more than people initially imagine.
Why ordinary users should stop assuming MFA alone is enough
A lot of people still believe enabling multi factor authentication automatically makes their account secure.
Security specialists say it is still extremely important and absolutely worth using.
But scams like Kali365 show that authentication systems can still be bypassed if users accidentally authorise malicious access themselves. And that is exactly what makes these attacks psychologically effective.
They exploit trust more than technical weaknesses. The email may appear normal. The verification request may appear routine. The user may believe they are protecting the account while actually handing over access. That is why cybersecurity experts keep repeating the same advice.
Slow down before approving unexpected login requests. Check whether you genuinely initiated the action yourself. And if something feels strange, stop before clicking anything further. Because modern phishing scams no longer rely only on stealing passwords.
Increasingly, they rely on convincing people that nothing suspicious is happening at all.
And with AI now helping attackers create more realistic scams than ever before, security experts believe many people will soon discover that online fraud no longer looks the way they expect it to.
The confession came almost four months after the planes exploded over the Caribbean Sea: “I told them to try to knock them down over [Cuban] territory, but they would enter Havana and leave.” It was June 1996, and the 11-minute, 32-second statement was recorded and later transferred to an old compact disc. “Of course, with one of those missiles, air-to-air, what comes down is a ball of fire that will fall on the city.” The man speaking didn’t know then that he was revealing the crime that would haunt him for the rest of his life: the downing of two planes belonging to the Brothers to the Rescue non-profit organization. “Well, knock them down into the sea when they reappear; and don’t consult those who have the authority.” The speaker was Raúl Castro. The U.S. Department of Justice now intends to prosecute him for the deaths of the four crew members, more than three decades ago.
On May 20, an unprecedented event could take place in the mecca of Cuban exiles: the U.S. Attorney’s Office for the Southern District of Florida is set to formally present its indictment against Castro in a ceremony at the Freedom Tower in Miami. This initiative comes amid the Trump administration’s siege against the regime on the island. Since the Republican president announced in January that Cuba was “next,” following the incursion into Venezuela to arrest Nicolás Maduro, Cubans have been watching closely for any sign that might shed light on Trump’s uncertain plans.
It’s hard for people to imagine a figure like Castro, now 94, being transferred to a maximum-security prison in the United States so near the end of his life. He’s no longer the powerful man who can sit down and talk with the United States, as he did during Barack Obama’s presidency in 2016. Now he sends his grandson, Raúl Guillermo Rodríguez Castro, to carry on his legacy. Time, however, hasn’t lessened his debt, nor has old age granted him any special treatment among the exile community. “I don’t know if we’ll ever see Raúl Castro before a U.S. court,” says Arnaldo Iglesias, 88, in his Miami home. “But I would like the full recognition of the truth. I want it established that four men were murdered by a dictatorship during a humanitarian mission.”
Iglesias’ memory has not erased the events of that February 24, 1996, when the two Cessna C-337 planes carrying his Brothers to the Rescue comrades were shot down between 3:21 p.m. and 3:27 p.m. by Cuban Air Force MiG fighter jets. A third plane, carrying Iglesias, managed to escape. “I remember the voices on the radio, the uncertainty, and then the silence. A silence that defies explanation.”
A week earlier, Iglesias had seen his friends all smiles in Nassau, Bahamas, during a Brothers to the Rescue humanitarian mission. The group was conducting search and rescue operations in the Florida Straits, with exiles and the help of the U.S. Coast Guard, to assist those who took to the sea from Cuba, the so-called rafters. Iglesias never saw Armando Alejandre, 45, Carlos Costa, 29, Mario de la Peña, 24, or Pablo Morales, 29, again. He still remembers details about each of them, as if time hasn’t taken them away.
“Carlos Costa had a special calmness. Mario de la Peña was an enthusiastic young man and a consummate environmentalist. Pablo Morales was a rafter rescued by us, helping others to achieve the freedom he already enjoyed, and Armando Alejandre Jr., an exemplary Cuban,” he says. “Thirty years later, I still think about them almost every day.”
The survivors, the families of the victims, and the exile community that has for years mourned the four Brothers to the Rescue crew members have patiently waited for justice to be served against the Castro regime. Nothing, so far, has happened. Five administrations have come and gone in the White House without a response, despite the fact that it has been proven the planes were shot down over international waters, not Cuban airspace, and that the U.S. Congress condemned the events on March 12, 1996. That year, Judge James Lawrence King ruled that the Castro regime had murdered “four human beings in international airspace over the Florida Straits.” Cuba refused to compensate the victims’ families, but the United States did so with $93 million in frozen Cuban government assets.
After Trump’s first term, during which he barely paid any attention to Cuba, perhaps no one in Havana expected him to now dedicate so much time to the island. Events indicate that Washington is determined to fight back: a nearly five-month-long oil embargo has been compounded by threats, negotiations, visits from officials, $100 million in humanitarian aid, and the revelation that Castro could face prosecution in U.S. courts. There is one piece of evidence now available to federal judges that forms the cornerstone of the ongoing case: a voice recording in which Raúl Castro admits that he gave the order to shoot down the planes.
Brothers to the Rescue at the center of politics
That audio fell into the hands of Cuban journalist Wilfredo Cancio in 2006, based in Miami and at the time a reporter covering Cuban affairs for El Nuevo Herald. Castro had assumed the presidency of Cuba a few days earlier, due to Fidel’s illness. Ten years prior, as Cuba’s Minister of Defense and head of the Armed Forces, he had admitted his responsibility for the attack on the planes in a meeting with journalists from the island.
Cancio verified the recording with several specialists and with Alcibiades Hidalgo, who was Castro’s personal secretary. It was his voice. On August 20, 2006, he published an exclusive report that garnered worldwide media attention. “What changes with this recording is that there is now voice evidence of Raúl Castro assuming full responsibility,” the journalist told EL PAÍS, adding that he sees the planned indictment as “an act of historical justice.” When asked if the FBI had contacted him at any point regarding the investigation, he declined to comment.
The case of the downing of the planes has followed the course of events dictated by South Florida politics. “In the 1990s, there were formal charges and accusations that were dropped by the Bill Clinton administration, which was difficult for the families of the four men killed to accept,” Iglesias recounts. Two years after the recording was made public, it was once again put on hold with Barack Obama’s arrival at the White House and the diplomatic rapprochement between the two countries. Castro not only visited the United Nations headquarters in New York but also hosted the Democrat for a two-day stay in the Cuban capital. Former spy Gerardo Hernández, linked to the attack on the planes, was sentenced in the United States to life imprisonment and then sent to Cuba in 2014 as part of a prisoner exchange.
Republicans, for their part, have called for Castro’s head: Rick Scott, former governor of Florida, and the current governor, Ron DeSantis, are demanding that the Justice Department file charges. CBS News broke the news about Castro’s possible prosecution on the same day that the CIA director arrived in Havana last week. “Everything that is being done is a form of pressure on Cuba and a symbolic act of justice, albeit belated, but justice nonetheless. There is pressure in Congress and in the community to prosecute Raúl and Fidel as those responsible for the crime,” Cancio comments. “The fact that accountability is being discussed again today sends an important message: state crimes do not simply disappear with the passage of time.”
In 1996, Fidel himself said that he was the one who gave the order that small planes could no longer fly over Cuban airspace to drop leaflets, as they had done before. “They had a general order not to allow it… They acted with full awareness that they were following orders… I take responsibility for that,” the late leader said. However, the leaked audio shows that the order was actually given by his brother Raúl.
Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition