05/22/2026
⚠️ NEW EMAIL SCAM WARNING ⚠️
Scammers are now tricking people into giving them access to their Microsoft 365 accounts — even if you use two-factor authentication (MFA).
Here’s how it works in simple terms:
📧 You get an email that looks like it’s from Microsoft, OneDrive, Teams, or another trusted service.
🔢 The email tells you to go to a REAL Microsoft login page and enter a “verification code.”
❌ The page is real — but the code was created by the scammer.
When you enter the code, you accidentally give the attacker permission to access your account.
They may then be able to read your:
• Outlook email
• OneDrive files
• Teams messages
• Other Microsoft services
And they can sometimes stay logged in WITHOUT needing your password again.
🛡️ HOW TO PROTECT YOURSELF:
• Never enter a login code from an email unless YOU started the login yourself.
• Be suspicious of emails telling you to “verify your device.”
• If something feels urgent or strange, stop and double-check.
• Turn on security alerts for your Microsoft account.
• Check your recent logins and connected devices regularly.
• If in doubt, close the email and go directly to Microsoft.com yourself.
🚨 Important:
Even if the website is real, the code can still be part of a scam.
Share this with friends and family!
If you have been hacked, I can help.
Today the FBI released a warning the public about Kali365—an emerging Phishing-as-a-Service (PhaaS) platform. Kali365, first seen in April 2026, enables cyber threat actors to obtain Microsoft 365 access tokens and bypass multi-factor authentication (MFA) protocols without intercepting the user’s credentials. The platform allows less-skilled attackers access to AI-generated phishing lures, automated campaign templates, real-time targeted individual/entity tracking dashboards, and OAuth token capture capabilities.
Learn more about how the scam works and review recommendations on how to protect yourself: ic3.gov/PSA/2026/PSA260521
