Kali365 and the FBI Warning (May 2026): MFA-Bypass Phishing Kits Go Mainstream
In May 2026, the FBI warned about Kali365, a phishing-as-a-service platform first observed in April 2026 that lets cybercriminals obtain Microsoft 365...
Service
Find what Microsoft 365 Copilot could expose — and fix it before rollout.
Copilot answers questions using everything a user can already open. In most tenants that includes years of overshared SharePoint sites, org-wide sharing links and HR or finance files that were never meant to be broadly visible. The first time a pilot user asks Copilot about salaries or an acquisition, the rollout stops.
Organizations piloting Microsoft 365 Copilot or planning to expand beyond a pilot group.
We need read access to SharePoint and Purview reports for the assessment. Any configuration changes are made by your team or by us only with written approval.
It usually speeds it up. A pilot that finds oversharing halfway through tends to pause for months; an audit up front keeps each wave moving.
Yes. Copilot licenses include SharePoint Advanced Management, and E3 includes core Purview labeling and DLP. We flag where E5 features would help.
In May 2026, the FBI warned about Kali365, a phishing-as-a-service platform first observed in April 2026 that lets cybercriminals obtain Microsoft 365...
MFA-bypass phishing kits steal tokens rather than passwords. Two Entra ID controls make stolen tokens much less useful: token protection and...
Since February 2026, a phishing-as-a-service platform known as EvilTokens has been used to compromise Microsoft 365 accounts through OAuth device code...