Want more Cyber Treats? https://facettech.com/cybertreats/
Unlike gardens, cybersecurity’s finest yield is nothing at all.
The Phishing Scam That Skips Your Password
If you’ve been reading Cyber Treats for a while, you know the usual phishing checklist: check the sender, hover over links, watch for lookalike domains and urgency cues. The FBI’s latest alert covers a scam that passes all of those tests. How? The sign-in page is legit.
Kali365 is a phishing kit that criminals can rent to target Microsoft 365 accounts (pretty cheaply, too: reports from cybersecurity researchers say it’s around $250 per month).
How It Works:
- You get an email that looks like someone shared a document with you. To view it, you’re told you need to verify your identity by signing in and entering the code provided.
- The page the link leads to really is Microsoft’s. You enter the code and sign in like normal, password and MFA prompt included.
- That code tied your login to the attacker’s device, and you just verified them. There was never a document.
From there, the attackers can access your Outlook, Teams, and OneDrive without ever needing your password or another MFA prompt.
How To Avoid This Scam:
Real document shares never arrive with a code already in the email. Those codes exist to connect a new device to your account, like signing into a streaming app on a TV. If an email hands you a code and tells you where to type it, stop. You didn’t set up a device, which means someone else did.
And while this campaign targets Microsoft 365, the same login shortcut exists on Google and many other services, so the habit travels: never enter a code you didn’t request.
Is MFA Still Worth It?
Yes. Criminals are paying subscription fees to get around it, which tells you how well it works everywhere else!
The best defenses against phishing include robust security measures and employee training.
Need guidance on cybersecurity training measures or reliable IT support? Reach out at (309) 689-3900 to book time with us to go over your strategy.
Now Available On-Demand: AI-Fluent Leader Sessions 1-6
The AI Fluent Leaders Series resumes August 19.
In the meantime, you can catch up on our previous sessions and be ready to join for Session 7!
Want more Cyber Treats? https://facettech.com/cybertreats/
Ellie Shaw is the Director of Marketing at Facet and the author of Cyber Treats, Facet's biweekly newsletter featuring topics like IT news, cybersecurity updates, compliance advice, and anything tech. She has been a member of the Facet team full-time since 2016 and enjoys finding new ways to share resources and information about cybersecurity with others.