Lost Your Microsoft Account to a Token-Theft Scam? How to Tell, and How to Get It Back

On 21 May 2026, the FBI issued a public warning about a phishing kit offered "as a service", called Kali365, which the security company Malwarebytes has also described. It hijacks Microsoft 365 accounts not by stealing your password, but by obtaining the access tokens that Microsoft issues to a device once a sign-in is approved.

That is the whole problem. The victim receives a fake document share or a fake Teams notification asking them to enter a code on a genuine Microsoft sign-in page, the one used to sign in a device. By entering that code, they actually authorise the attacker's device, which receives access and refresh tokens tied to the account. According to the FBI, the attacker then gets into the account without needing the password or any further multi-factor authentication step.

It is tempting to file this under corporate IT problems. It is not only that: the FBI is targeting Microsoft 365 accounts, and the same caution applies to anyone who uses Outlook or a Microsoft subscription. If you think your account has been hijacked, here is how to spot it and what to do.

How to tell if your account has been hacked

This type of attack is discreet, so the signs are often subtle. Each of them deserves a closer look:

• a sign-in or a device you do not recognise in your account's recent activity (Microsoft then lets you choose "This wasn't me") or in your list of devices;
• emails in your Sent folder that you never wrote, or messages missing from your inbox;
• automatic forwarding, an automatic reply or an inbox rule that you did not create;
• password reset alerts for other accounts (bank, social networks) that you did not request;
• contacts telling you they received an unexpected "shared document" or sign-in request from you.

If you see these signs, treat the account as compromised and act quickly.

The recovery procedure, step by step

Do this from a trusted device, not from the one you suspect was involved.

1. If you can no longer sign in, use Microsoft's sign-in helper tool, which points you to the right recovery procedure.
2. Scan your computer. Microsoft recommends making sure your antivirus is up to date and running a full scan before you change your password.
3. Change your password, or reset it if you cannot sign in, choosing a strong password.
4. Sign out everywhere. In the advanced security options of your Microsoft account, the "Sign out everywhere" section signs you out of your trusted devices. According to Microsoft, you will be signed out of browsers and apps within 24 hours; an Xbox console has to be signed out separately. For a work or school account, also alert your IT department.
5. Check your mailbox settings. Microsoft says it resets some settings after an account is hacked, and asks you to check connected accounts, forwarding and automatic replies. Also check your inbox rules and delete any you did not create.
6. Check your security info. Make sure the recovery email and phone, and the registered multi-factor authentication methods, are really yours; remove any you did not add.
7. Check connected devices and apps, and remove any you do not recognise.
8. Find out what was affected: OneDrive sharing links, messages read or sent, so you know who else needs to be warned.

Report it

Reporting will not restore your account on its own, but it creates a record you may need later. In the United States, the FBI receives reports through its Internet Crime Complaint Center (ic3.gov). In the European Union, report it to the police in your country. If the hack exposed personal data, especially other people's, the data protection authority of your country can also be informed.

When recovery stalls, and where AccountRights comes in

Most account takeovers can be undone with the steps above. Some cannot: the account stays stuck in a verification loop, the attacker has replaced the recovery information with their own, or the provider's automated process keeps refusing you access. It is the same wall that people whose Facebook or Instagram accounts were hacked run into: the self-service tools run out.

To be clear: AccountRights is not technical support. We cannot reset your password or sign you back in, and the steps above remain the right starting point. We come in at the step after, when a legitimate owner has done everything right and the account remains out of reach, or when the loss has caused real harm.

At that point, the levers become legal. Article 15 of the GDPR gives you a right of access to the personal data the provider holds about you, with an answer due within one month, which can be extended by two months. A formal letter addressed to the provider's legal department can set out the facts, the evidence and your status as the account holder, and request that access be restored. The AccountRights free diagnostic takes about five minutes and points you to the most suitable solution: a letter sent by AccountRights, a letter drawn up, signed and sent by an independent partner lawyer, or full case handling by an AccountRights partner lawyer, with whom you agree the fees directly, in writing, before any work.

Start the free diagnostic

The best recovery is not needing one

One habit defeats this whole category of attack: never enter a sign-in code on a Microsoft page just because an email, a document share or a Teams invitation asks you to. Only do it when you started the sign-in, on your own device. With this scam, the page really is Microsoft's: that is what makes it effective.

Sources

• FBI IC3: public service announcement of 21 May 2026 on Kali365
• Malwarebytes: Kali365 phishing kit bypasses MFA and steals Microsoft logins (27 May 2026)
• Microsoft: how to recover a hacked or compromised Microsoft account
• Microsoft: how to sign out of your Microsoft account everywhere