FBI Warning: Microsoft 365 Phishing Attacks Hit Las Vegas Businesses

A new wave of Microsoft 365 phishing attacks is hitting Las Vegas businesses, and the FBI has issued a formal warning about the toolkit powering it. The threat actor–operated service, known as Kali365, first emerged in April 2026 and is specifically engineered to steal Microsoft 365 authentication tokens — which means it bypasses multi-factor authentication entirely. If your Las Vegas business relies on Microsoft 365 for email, Teams, or document collaboration, this threat is aimed at you.

At the same time, cybersecurity firm Huntress documented a separate but related campaign that began September 10, 2026: attackers abused legitimate Microsoft Power BI domains to host convincing fake reference documents. Employees who clicked were prompted to download rogue ScreenConnect remote access installers — handing attackers an invisible backdoor into company networks. For Las Vegas hospitality operators, healthcare providers, legal firms, and construction contractors — all heavy Microsoft 365 users — this combination of threats is especially dangerous heading into Q4.

How Kali365 Bypasses Microsoft 365 Multi-Factor Authentication

Traditional phishing steals your password. Kali365 steals something more powerful: your session authentication token. Here is how it works. After an employee logs in to Microsoft 365 and completes their MFA prompt, Microsoft issues a short-lived token proving the session is legitimate. Kali365 uses an adversary-in-the-middle (AiTM) technique — placing itself invisibly between the employee and Microsoft’s real login page — to intercept that token the moment it is issued. The attacker now controls a fully authenticated M365 session without ever knowing the employee’s password or MFA code.

Once inside, attackers move fast. They search emails for pending wire transfers and impersonate executives to redirect payments. They exfiltrate sensitive client files from SharePoint and OneDrive. They plant persistent malware across connected cloud services. For a Clark County government contractor, a Henderson medical practice, or a Las Vegas casino supplier, a single compromised account can cascade into a full breach within hours — and without any visible warning sign to the victim.

The Power BI Document Trap: A New Delivery Method Las Vegas Businesses Must Know

The Power BI phishing campaign documented by Huntress is particularly dangerous because it weaponizes a trusted Microsoft domain. Attackers host malicious content directly on powerbi.com — a domain that email security tools and web filters automatically trust. Employees receive what appears to be an internal company report or a colleague’s data file. When they click and are prompted to “download the viewer,” they are actually installing a rogue ScreenConnect remote management agent.

ScreenConnect is a legitimate tool used by IT providers — including managed service providers like CMIT Solutions — to remotely support client machines. Attackers exploit that built-in trust. Once the rogue agent runs, the attacker has persistent, silent remote control of the endpoint. They can disable security tools, exfiltrate data quietly in the background, and maintain a foothold that survives password resets and reboots. Microsoft has also warned that AI now allows attackers to personalize every phishing message at scale, turning what used to be rare targeted attacks into mass operations that feel custom-crafted to each recipient.

• Attack method: Adversary-in-the-middle (AiTM) proxy intercepts Microsoft 365 login sessions and captures session tokens after MFA is completed, bypassing all standard two-factor controls
• Delivery vector: Phishing emails link to fake documents hosted on legitimate Microsoft Power BI or SharePoint domains, evading email security filters that trust Microsoft URLs
• Payload: Rogue ScreenConnect remote access agent installed silently, giving attackers persistent, undetected control of the victim’s device
• Escalation path: Token theft leads to account takeover, then data exfiltration, ransomware deployment, and supply chain attacks against your own clients
• AI amplification: AI enables attackers to craft highly personalized phishing messages at volume — making mass phishing campaigns look and feel like targeted spear phishing to every individual recipient

What Is at Risk for Las Vegas Small Businesses

• ⚠ Complete M365 account takeover — attackers gain simultaneous control of email, Teams, SharePoint, and OneDrive, with no visible sign of compromise to the victim during the intrusion
• ⚠ Business email compromise (BEC) — attackers impersonate your executives or trusted vendors to redirect wire transfers; Las Vegas construction firms and real estate operations are frequent BEC targets because of high-dollar transaction volumes
• ⚠ HIPAA and regulatory exposure — Las Vegas medical offices, dental practices, and behavioral health providers that store patient records in M365 SharePoint face significant fines and mandatory breach notification if patient data is exfiltrated
• ⚠ Supply chain propagation — a compromised account automatically becomes a trusted source for malicious links sent to every contact in your company address book, spreading the attack to clients and partners
• ⚠ Triple extortion ransomware — even if you pay, attackers may publish your stolen data and then contact your clients demanding a second ransom from them, as documented in Q3 2026 reports

Defending Las Vegas with CMIT Solutions

CMIT Solutions of Las Vegas specializes in Microsoft 365 security for Clark County businesses — monitoring M365 environments around the clock, enforcing conditional access policies, and running phishing simulations tailored to the specific threats your industry faces. When attackers develop new tools like Kali365, we update our defensive protocols before those threats land in your inbox.

Las Vegas is a high-value target. Our hospitality and gaming sectors handle millions of guest records. Our healthcare providers carry strict HIPAA obligations. Our legal and financial firms manage client data that is irreplaceable. The FBI has issued its warning — the question now is whether your business will act on it before an attacker does.