Advanced Network Consulting

Cyber criminals love swindling new targets. One despicable thing that they will do is share tools of evil with like-minded individuals, so they can spread their malicious intent around the globe.
A few months ago, the FBI issued a warning about a phishing-as-a-service platform (PhaaS) identified as Kali365. Cyber criminals have been distributing the kit primarily through Telegram, and with this phishing kit, hackers can gain persistent access to a victim’s Microsoft 365 account.

Like a typical phishing attack, these attacks begin when the hackers send a phishing message, primarily through email, impersonating a trusted cloud service provider. The message contains a code, in which if the victim goes to a fake Microsoft verification page and enters this code, it will grant the cyber criminals access to their device.
If you come across one of these messages in your account, the FBI recommends you do the following:
1. Restrict device code flow to limit/block device authentication codes
2. Create a conditional access policy to block device code flow for all users (include limited exceptions for necessary business processes)
3. Block authentication transfer policies to prevent users from transferring authentication to outside devices.
4. Exclude emergency access accounts to avoid lockouts.