<\/p>\n
A new phishing-as-a-service toolkit is hijacking M365 tokens and bypassing multi-factor authentication — your employees could be next<\/p>\n
Published by CMIT Solutions of Las Vegas · Cybersecurity · 6 min read<\/p>\n<\/div>\n
A new wave of Microsoft 365 phishing attacks<\/strong> is hitting Las Vegas businesses, and the FBI has issued a formal warning about the toolkit powering it. The threat actor–operated service, known as Kali365<\/strong>, first emerged in April 2026 and is specifically engineered to steal Microsoft 365 authentication tokens — which means it bypasses multi-factor authentication entirely. If your Las Vegas business relies on Microsoft 365 for email, Teams, or document collaboration, this threat is aimed at you.<\/p>\n At the same time, cybersecurity firm Huntress documented a separate but related campaign that began September 10, 2026: attackers abused legitimate Microsoft Power BI domains to host convincing fake reference documents. Employees who clicked were prompted to download rogue ScreenConnect remote access installers — handing attackers an invisible backdoor into company networks. For Las Vegas hospitality operators, healthcare providers, legal firms, and construction contractors — all heavy Microsoft 365 users — this combination of threats is especially dangerous heading into Q4.<\/p>\n Traditional phishing steals your password. Kali365 steals something more powerful: your session authentication token<\/strong>. Here is how it works. After an employee logs in to Microsoft 365 and completes their MFA prompt, Microsoft issues a short-lived token proving the session is legitimate. Kali365 uses an adversary-in-the-middle (AiTM) technique — placing itself invisibly between the employee and Microsoft’s real login page — to intercept that token the moment it is issued. The attacker now controls a fully authenticated M365 session without ever knowing the employee’s password or MFA code.<\/p>\n Once inside, attackers move fast. They search emails for pending wire transfers and impersonate executives to redirect payments. They exfiltrate sensitive client files from SharePoint and OneDrive. They plant persistent malware across connected cloud services. For a Clark County government contractor, a Henderson medical practice, or a Las Vegas casino supplier, a single compromised account can cascade into a full breach within hours — and without any visible warning sign to the victim.<\/p>\n The Power BI phishing campaign documented by Huntress is particularly dangerous because it weaponizes a trusted Microsoft domain<\/em>. Attackers host malicious content directly on powerbi.com — a domain that email security tools and web filters automatically trust. Employees receive what appears to be an internal company report or a colleague’s data file. When they click and are prompted to “download the viewer,” they are actually installing a rogue ScreenConnect remote management agent.<\/p>\n ScreenConnect is a legitimate tool used by IT providers — including managed service providers like CMIT Solutions — to remotely support client machines. Attackers exploit that built-in trust. Once the rogue agent runs, the attacker has persistent, silent remote control of the endpoint. They can disable security tools, exfiltrate data quietly in the background, and maintain a foothold that survives password resets and reboots. Microsoft has also warned that AI now allows attackers to personalize every phishing message at scale, turning what used to be rare targeted attacks into mass operations that feel custom-crafted to each recipient.<\/p>\n The Gap<\/span> Standard SMS codes and authenticator-app MFA do not stop AiTM token theft. Kali365 was built specifically to defeat these controls. Many Las Vegas businesses believe they are protected because they already have “some form of MFA” — but standard MFA is no longer sufficient against this threat class.<\/p>\n The Fix<\/span> Upgrade to FIDO2-compliant phishing-resistant MFA — hardware security keys or Microsoft Passkey authentication — for all M365 accounts. Enable Microsoft Entra ID Conditional Access policies that detect and block session token replay attempts. CMIT can deploy this across your organization without disrupting daily operations or requiring your team to learn a new workflow.<\/p>\n<\/div>\n The Gap<\/span> Remote management tools like ScreenConnect are legitimate when deployed by your IT provider — but endpoint security rarely blocks them by default because of their legitimate use. Most Las Vegas small businesses have no policy restricting which remote tools can be installed or by whom, leaving a wide-open door for attackers using rogue agents.<\/p>\n The Fix<\/span> Work with your MSP to establish an application allowlist that restricts which remote tools can run on company machines to only pre-approved IT-provider tools. Pair this with endpoint detection and response (EDR) that alerts in real time when any new remote agent is installed. Establish a firm company rule: any unsolicited prompt to download software — even from a Microsoft domain — should be reported to IT before clicking, never installed on the spot.<\/p>\n<\/div>\n The Gap<\/span> Employees have been taught to check that a URL contains “microsoft.com” before trusting it. Now attackers host malicious content directly on legitimate Microsoft domains — Power BI, SharePoint, OneDrive — making the old URL-check rule useless. Annual security awareness training has not caught up to this tactic.<\/p>\n The Fix<\/span> Run quarterly phishing simulations that include trusted-domain scenarios: Power BI links, SharePoint file requests, and OneDrive invitations that prompt unexpected software downloads. Establish and communicate a clear rule across your team: your IT provider will never send an unsolicited link asking employees to download software. Any such request — even from a Microsoft domain — is a red flag to report, not to click. Deploy Microsoft Defender for Office 365 Safe Links to re-scan URLs at the moment of click rather than only at delivery.<\/p>\n<\/div>\n Kali365 is active right now. One hijacked M365 account can cost your business hundreds of thousands of dollars and months of recovery time. CMIT Solutions of Las Vegas provides Microsoft 365 security assessments for Clark County businesses — find your vulnerabilities before attackers do.<\/p>\n Get Your Free M365 Security Assessment<\/a>\n<\/div>\n CMIT Solutions of Las Vegas specializes in Microsoft 365 security for Clark County businesses — monitoring M365 environments around the clock, enforcing conditional access policies, and running phishing simulations tailored to the specific threats your industry faces. When attackers develop new tools like Kali365, we update our defensive protocols before those threats land in your inbox.<\/p>\n Las Vegas is a high-value target. Our hospitality and gaming sectors handle millions of guest records. Our healthcare providers carry strict HIPAA obligations. Our legal and financial firms manage client data that is irreplaceable. The FBI has issued its warning — the question now is whether your business will act on it before an attacker does.<\/p>\n Microsoft 365 is the backbone of your business communications and data. Don’t let a phishing-as-a-service toolkit take it over. Contact CMIT Solutions of Las Vegas for a no-obligation M365 security review and find out exactly where your vulnerabilities are before an attacker does.<\/p>\nHow Kali365 Bypasses Microsoft 365 Multi-Factor Authentication<\/h2>\n
\n Q3 2026 set a record for ransomware attacks globally. The average ransom demand reached $602,400<\/strong> — more than double the figure from two years prior. Attackers are now deploying “triple extortion”: they lock your data, threaten to publish it publicly, then go after your own clients if you don’t pay. The FBI’s warning about Kali365 is a direct response to this escalating landscape. (Source: Comparitech \/ Infosecurity Magazine, October 2026.)<\/em>\n<\/div>\nThe Power BI Document Trap: A New Delivery Method Las Vegas Businesses Must Know<\/h2>\n
\n
What Is at Risk for Las Vegas Small Businesses<\/h2>\n
\n
▸ Step 1: Upgrade to Phishing-Resistant MFA Now<\/h3>\n
▸ Step 2: Lock Down Unauthorized Remote Access Tools<\/h3>\n
▸ Step 3: Retrain Employees on Trusted-Domain Phishing<\/h3>\n
Defending Las Vegas with CMIT Solutions<\/h2>\n
\n The Hacker News — FBI Warning: Kali365 Phishing-as-a-Service Targeting Microsoft 365 (2026)<\/a>
\n Infosecurity Magazine — Q3 2026 Sets New Record for Ransomware Attacks (October 2026)<\/a>\n<\/div>\nProtect Your Las Vegas Business Today<\/h2>\n