Microsoft 365

The Greatness phishing-as-a-service (PhaaS) platform has expanded to include adversary-in-the-middle attacks and device-code phishing, targeting Microsoft 365 accounts by spoofing RingCentral.

Microsoft has linked a global campaign targeting hospitality Wi-Fi networks to the Russian threat actor Midnight Blizzard, also known as APT29. The attacks use custom malware to breach Microsoft 365 accounts.

Microsoft has issued a warning about hotel Wi-Fi networks being exploited by Russian hackers to target travelers through fake Microsoft 365 login pages. These pages can steal credentials or deliver malware, with some displaying a 'working on updates' message. The company advises using a phone hotspot for safer connectivity.

Hackers are tampering with Wi-Fi equipment at hotels and conference centers to redirect users to fake Microsoft 365 login pages, posing risks to business travelers. ReliaQuest reports the campaign has been active since June, affecting multiple industries across U.S. cities through compromised Wi-Fi gateways.

Okta's Enterprise AI Index highlights Anthropic, OpenAI, and Cursor as leaders in corporate customer growth. Established tools like Google Workspace, GitHub, and Microsoft 365 are also among the fastest-growing AI applications, indicating companies are enhancing existing software with AI rather than replacing it entirely.

Microsoft is seeking the UK Supreme Court's permission to appeal a 2025 Competition Appeal Tribunal (CAT) ruling that allowed the resale of its on-premise software licenses. The company previously lost a Court of Appeal challenge against ValueLicensing, which claims Microsoft restricted the supply of surplus Office licenses, potentially leading to a £270 million payout.

Hackers are altering DNS settings on Wi-Fi devices at hotels and conference centers to redirect users to fake Microsoft 365 login pages. This tactic is used to steal Microsoft 365 accounts by intercepting login credentials.

October 2026 will see the end of support for multiple Microsoft products, including Office LTSC 2021, Windows Server 2022, Windows 11 versions, and Microsoft Publisher 2021. Admins must migrate to newer versions or Microsoft 365 to maintain support, while Entra ID Sign-In risk policies will be retired, requiring a shift to Conditional Access.

German and US law enforcement dismantled the Kratos phishing kit, a tool designed to steal Microsoft 365 sessions and bypass MFA. Indonesian authorities arrested the individual allegedly responsible for developing and operating the kit, as confirmed in a joint announcement by Frankfurt's cybercrime unit (ZIT) and Germany's BKA.

HollowGraph malware, discovered by Group-IB, uses hijacked Microsoft 365 calendars as a command channel, hiding operator instructions and stolen files in calendar events dated 2050. The malware leverages Microsoft Graph API traffic to blend malicious activity with legitimate traffic.

A misconfigured Python web server exposed a Microsoft 365 phishing operation, allowing security firm Lexfo to uncover the attacker's toolkit and link it to two additional phishing campaigns. The attacker's command history revealed the server setup, which was left publicly accessible with directory listing enabled.

The FBI warns about a phishing-as-a-service platform called Kali365 targeting Microsoft 365 accounts. The scam bypasses multifactor authentication by exploiting Microsoft's device code login process to steal OAuth tokens, granting attackers access to Outlook, Teams, and OneDrive without requiring passwords.

A senior director at a cybersecurity company, who was allegedly its COO, overreacted to a multi-factor authentication (MFA) rollout for Microsoft 365, falsely claiming it crippled an invoicing system. The actual issue was a buggy invoicing software, but the director demanded an immediate rollback, resulting in reduced security. The incident highlighted poor decision-making despite the team's successful implementation.

A user's mother received a PayPal charge for Microsoft 365 without purchasing it, and the billing email appears to be from 'billing.microsoft.co', which is not recognized as an official Microsoft billing domain. The user is unsure if this is a scam.

The author stopped paying for Microsoft 365 and purchased Microsoft Office 2024 Home & Business for $104.97, a one-time fee available until June 14, as an alternative to ongoing subscription costs.

Microsoft will disable Office 2019 for Mac next month by not renewing a validation certificate, forcing users to upgrade to Office 2024 or a Microsoft 365 subscription. The company revised its support statement to clarify apps will stop working, contradicting earlier assurances they would 'continue to function.'

A Chinese espionage group named UNC5221 is using new malware, including Brickstorm, Plenet, and AgentPSD, to maintain access to hacked Microsoft 365 environments.

A disabled security setting in Android versions of Microsoft apps like Word, PowerPoint, and Excel allowed attackers to steal user logins and data. The vulnerability stemmed from a coding error that exposed Microsoft 365 accounts to potential takeover.

The FBI-flagged phishing kit Kali365, previously targeting Microsoft 365, now expands to AWS, Okta, and Russian platforms using device code phishing. This marks an increase in the platform's scope and threat level.

Microsoft launched Scout, a new AI assistant inspired by OpenClaw, designed to integrate the capabilities of OpenClaw into the Microsoft 365 ecosystem. The assistant was introduced at Microsoft's Build event.

Microsoft Scout is a new AI personal assistant built on OpenClaw, designed to integrate into Microsoft 365 apps like Outlook, OneDrive, and Teams. It assists with tasks such as organizing calendars, expense reporting, and email drafting, offering broader capabilities than Microsoft's Copilot. Corporate vice president Omar Shahine described it as the first real personal assistant offered by Microsoft.

Microsoft redesigned its Copilot app for Microsoft 365, introducing a faster interface, improved response times for complex prompts, and a task-aware workspace for prompts. The update addresses user complaints about a disruptive floating button, offering an option to move it to the ribbon. Copilot usage increased by 27-43% across Word, Excel, PowerPoint, and Outlook following the changes.

The FBI warns of a phishing scam targeting Microsoft Outlook and 365 users, using a pre-packaged phishing kit called Kali 365 distributed via Telegram. Hackers exploit OAuth tokens to bypass multi-factor authentication, gaining unauthorized access to accounts and services like Outlook, Teams, and OneDrive.

The FBI has issued a public warning about a new phishing tool that allows cyber attackers to access Microsoft 365 user accounts without requiring passwords. This tool is being used to hijack log-ins for Microsoft Outlook, Teams, and 365 services.

The FBI has issued a warning about the Kali365 phishing-as-a-service platform, which exploits OAuth device code authentication to hijack Microsoft 365 accounts. The service steals session tokens and bypasses multi-factor authentication (MFA), posing a significant cybersecurity threat.

The FBI warns about Kali365, a phishing-as-a-service platform targeting Microsoft 365 users by bypassing multi-factor authentication through OAuth device code phishing. The tool enables cybercriminals to steal access tokens, leading to data theft, ransomware, and other attacks. Researchers note its rapid growth, AI-driven tactics, and low barriers for less-technical attackers.

The FBI has issued a warning about Kali365, a phishing-as-a-service platform operating on Telegram that enables cybercriminals to steal OAuth tokens and gain unauthorized access to Microsoft 365 environments. The advisory follows attacks in April targeting Microsoft 365 users. This threat represents a significant security risk for organizations relying on cloud-based Microsoft services.

Yusuf Mehdi, Microsoft's executive vice president and consumer chief marketing officer, announced his departure after 35 years with the company, effective next year. He will continue leading marketing efforts for Windows, Copilot for consumers, and Microsoft 365 consumer business until 2027. Mehdi cited the need for time and space to ensure the team's continued success during this critical period for Microsoft.

Plex is increasing the price of its Lifetime Plex Pass from $249.99 to $749.99, effective July 1, in an effort to encourage recurring subscriptions over one-time payments. Existing Lifetime Plex Pass holders will not be affected by the price change. The move reflects a growing trend in the tech and streaming industries towards subscription-based models.

A threat actor is targeting Microsoft 365 and Azure production environments, stealing data by abusing legitimate applications and administration features, including Microsoft Self-Service Password Reset. The attacks are leveraging legitimate tools to gain unauthorized access. This has led to data theft in various instances.

A phishing-as-a-service platform called EvilTokens compromised over 340 Microsoft 365 organizations across five countries in just five weeks. The targets received a message asking them to enter a short code and complete their normal MFA challenge. This phishing attack bypassed multi-factor authentication.

The Tycoon2FA phishing kit has been updated to support device-code phishing attacks, allowing it to hijack Microsoft 365 accounts by abusing Trustifi click-tracking URLs. This new capability enables attackers to gain unauthorized access to sensitive information. The phishing kit's evolution poses a significant threat to account security.