The FBI has issued an urgent warning regarding the 'Kali365' phishing kit, a sophisticated toolset that facilitates the theft of session tokens to bypass Multi-Factor Authentication (MFA). Unlike traditional phishing that seeks to harvest passwords, Kali365 uses an Adversary-in-the-Middle (AiTM) approach to intercept the authentication process in real-time. When a user attempts to log in to a spoofed Microsoft 365 page, the kit proxies the request to the legitimate service, captures the resulting session cookie, and hands it to the attacker. This allows the threat actor to clone the user's authenticated session, gaining full access to emails, files, and administrative consoles without ever knowing the user's password or triggering a secondary MFA prompt. According to Graham Cluley and FBI field reports, the kit is being distributed via highly targeted spear-phishing campaigns that use 'Code of Conduct' or 'Urgent IT Update' lures. The technical sophistication of Kali365 lies in its ability to mimic the look and feel of legitimate corporate portals while simultaneously managing the complex back-end logic required to maintain the proxied session. This trend reflects a broader shift in the threat landscape where 'identity' is the primary target, and traditional security controls like SMS or app-based MFA are no longer sufficient. The FBI notes that even organizations with robust security postures are falling victim to this technique because it exploits the inherent trust in the session token itself. To combat this, security architects are urged to move toward FIDO2-compliant hardware security keys, which are resistant to AiTM attacks, and to implement 'Conditional Access' policies that require compliant, managed devices for all cloud logins. The rise of Kali365 demonstrates that the 'MFA is enough' era is officially over, necessitating a transition to phishing-resistant authentication frameworks across all critical business functions.