New Microsoft 365 phishing threat bypasses multi-factor authentication

Potential compromise of sensitive data and account access for affected Microsoft 365 users, with possible identity theft and financial fraud implications.

A sophisticated phishing campaign known as Kali365 or EvilTokens is quietly rewriting the rules of digital trust, targeting Microsoft 365 users not by stealing passwords but by harvesting the session tokens that authentication itself produces. In doing so, it renders multifactor authentication — long held as the gold standard of account protection — insufficient on its own. The FBI and multiple security firms have raised alarms, signaling that this is not an isolated incident but a coordinated challenge to the assumptions underlying modern cybersecurity. It is a reminder that every lock, once

New Microsoft 365 phishing threat bypasses multi-factor authentication

Related Coverage

Get The Register in your inbox