Security researchers have documented Kali365, a commercial Phishing-as-a-Service platform that exploits Microsoft’s OAuth device code authentication flow to hijack Microsoft 365 accounts. Attackers trick users into authorizing access on a legitimate Microsoft login page, generating a persistent session token that bypasses multi-factor authentication entirely. Any organization relying on Microsoft 365 for email, file storage, or collaboration is at risk of account takeover, data exfiltration, and business email compromise without credential theft.