USA

Cyber attackers are hijacking Microsoft Outlook, Teams and 365 log-ins, FBI says

(NEXSTAR) – A new phishing tool allows cyber attackers to access Microsoft 365 users’ accounts without needing to know your password, the FBI said. A warning was made to the public on Thursday.

The phishing platform, called Kali365, was first spotted in April, according to the FBI. It is distributed primarily through the messaging app Telegram and allows cyber attackers to bypass multi-factor authentication.

The scam starts with a trap, usually a phishing email that impersonates a trusted source such as a document sharing service. “This phishing email contains a device code with instructions to visit a legitimate Microsoft verification page and enter the code,” the FBI warns.

When you go to the real Microsoft page and paste the code, you unknowingly give the attacker access to your account. From there, they can capture authorization tokens that grant access to your Microsoft 365 software, including Outlook email, Teams messages, and OneDrive files. They don’t need to know your password or use multi-factor authentication to access your account.

The FBI says this new phishing platform, Kali365, makes it easier for unskilled attackers to use AI-generated phishing traps to steal authorization codes and target and track individuals in real time.

To protect yourself from the Kali365 attack, the FBI recommends the following:

Creating a “conditional access policy” that will block all users from the device code stream, with limited exceptions
Checking who currently has access to code stream usage to ensure it is legitimate
Blocking users’ ability to transfer authentication from computers to mobile devices
Exclude emergency access accounts to avoid crashes

A Microsoft spokesperson told Nexstar that the company acknowledged the FBI’s guidance and made a few additions more best practices:

Learn to spot phishing attempts in the first place to avoid falling prey to scammers
Do not open files from unknown senders that may download malware to your device
Make sure your operating system and applications are updated with the latest fixes

The company added that it is “actively working to disrupt the cybercrime ecosystems behind phishing and account takeovers as a service to protect our customers.”

Head to The Hill for the latest news, weather, sports and streaming video.