Security experts caution MFA alone can no longer stop threat actors

Security experts and the FBI are warning that MFA alone is no longer sufficient protection against modern phishing attacks. New phishing-as-a-service platforms like Kali365 and EvilTokens enable even novice attackers to steal Microsoft 365 OAuth tokens by tricking users into entering device codes on legitimate Microsoft pages, bypassing MFA entirely. Kali365 offers AI-generated lures, multilingual templates, and management dashboards for as little as $250/month. Mitigations include restricting OAuth device code flow via Conditional Access policies, enforcing phishing-resistant FIDO2/passkey MFA, proactively revoking tokens, monitoring for suspicious OAuth activity and device registrations, and adopting identity-centric security with continuous access evaluation.