Most business owners have been told to watch for fake login pages. That advice still matters, but newer phishing attacks are getting trickier.
The FBI recently warned about a phishing-as-a-service platform called Kali365 that targets Microsoft 365 accounts. One of the concerning tactics involves “device-code phishing.” In plain English, that means an attacker tricks someone into entering a code on a real Microsoft verification page. The page may look legitimate because it is legitimate, but the request did not come from a safe source.
That is what makes this type of attack so dangerous for small businesses. Employees may think, “I’m on the real Microsoft site, so this must be fine.” Unfortunately, the attacker may be using that real sign-in process to gain access to email, Teams, OneDrive, or other Microsoft 365 services.
A typical attack may start with an email, Teams message, or document-sharing request that looks routine. The message tells the employee to enter a code at a Microsoft verification page.
Once the employee enters the code, they may unknowingly approve the attacker’s device or session. The attacker may then receive access tokens, which can allow account access without needing the employee’s actual password.
For a small business, that can quickly become a serious problem. A compromised Microsoft 365 account may expose invoices, customer messages, contracts, files, internal conversations, and payment instructions.
Multi-factor authentication is still one of the most important protections a business can use. But this type of phishing shows why MFA should not be treated as a magic shield.
If an employee is tricked into approving the wrong sign-in flow, the attacker may get around the protection by abusing the approval process itself. That does not mean businesses should stop using MFA. It means MFA should be paired with smarter policies, user training, monitoring, and conditional access rules.
Start with a simple staff reminder: never enter a device code or approve a sign-in request unless you personally started the login and know exactly what device or app you are approving.
Then review your Microsoft 365 security setup. Important steps include:
A Microsoft 365 account is often the front door to a business. If an attacker gets into one account, they may use it to send believable messages to coworkers, customers, vendors, or bookkeepers.
That can lead to wire fraud, invoice redirection, data exposure, customer trust issues, and downtime while the account is cleaned up. For small businesses, the cleanup can be disruptive because the same tools used for daily work are often the tools affected by the attack.
Himala and his team at Cybernetic Networks have been amazing. We have been a customer of Cybernetic Networks for well over 14 years now, both personally and professionally. Himala and his team are professional, reachable and on the cutting edge of technology. We have enjoyed doing business with Cybernetic Networks for many years and still rely on their knowledge, skills and technology every day
Himala and his Cybernetic team have never let me down! For over 10 years now they have been fixing my technical issues, set up all my new networks and computers and have safeguarded me from any hackers or malware. You can trust this company to navigate you as your company grows and to keep you on track with the latest in security and safety
I am a solo practicing neurologist and have had all my IT needs covered through Cybernetic Networks since 2007. They are the best! All of their tech support staff is extremely knowledgeable and efficient. Just as importantly, they are quickly responsive whenever we need their assistance. I couldn’t be happier with their service and give them my highest recommendation!
I couldn't be happier with Cybernetics - they are experts, always respond quickly , and solves any issues I have.
Cybernetic Networks has been advising and supporting all our IT issues and purchases for the last 18 years. They are very responsive and extremely knowledgeable- always providing us with timely services.
It is not often you find small business companies that are not only rewarding to work with, but also have integrity, truth and skill. I have worked with this company for over 20 years, and the service is outstanding. I can easily recommend that if you need an IT company, this is the one to get. Full STOP! Look no further, you will be happy that you did. Sue Myhelic, Gulf Breeze Real Estate, Naples, Florida.
Himala and his team from Cybernetic Networks, Inc. has been an integral part of our successful retail business for the past 20 years. He is extraordinarily knowledgable and always available for our IT needs. Thanks to Himala and his team we are always up and running.
