The IT Nerd

The FBI has put out a warning about Kali365 and the spike in device code phishing attacks earlier this week:

Through the Kali365 platform subscription, cyber threat actors can capture “OAuth” tokens and gain persistent access to targeted individuals/entities’ Microsoft 365 environments. Kali365 lowers the barrier of entry, providing less-technical attackers access to AI-generated phishing lures, automated campaign templates, real-time targeted individual/entity tracking dashboards, and OAuth token capture capabilities.

But the deeper story is why this class of attack is so hard to catch. There’s no malicious link, no spoofed login page — just a legitimate OAuth flow handing attackers a valid token, bypassing everything traditional security is trained to flag.

Gidi Cohen, CEO & Co-founder, Bonfy.AI had this comment:

“The FBI’s warning is well-placed, and the recommended mitigations — conditional access policies, blocking device code flows — are the right first response. But they address the front door.

The harder question is what happens once an attacker is already inside a legitimate session. When a token is stolen, the attacker isn’t a stranger to the system anymore. They’re operating with valid credentials through authorized pathways. Traditional controls see a clean session. They don’t see intent.

That gap gets wider as AI enters the picture. Copilots and agents connected to M365 mean a compromised session isn’t just access to stored data — it’s a potential entry point into ongoing AI workflows, retrieval pipelines, and generated outputs that can surface sensitive information in ways that are much harder to detect.

The industry conversation tends to stop at authentication. It needs to extend to the data layer — what’s actually moving through these systems, what it contains, who it’s about, and whether that movement aligns with policy intent. Because by the time data is in motion, the authentication question has already been answered. Correctly or not.”

As mentioned, this technique is particularly dangerous because it exploits legitimate authentication workflows, making detection more difficult. Thus the mitigations that are recommended are vital to keeping your organization safe.

You might recall that a med tech company named Stryker got pwned in epic fashion by Iran based threat actors. Click here if you need to get the details on that. Now there’s news that the FBI has seized two websites used by the threat actors behind this attack who are known as Handala:

As of Thursday, the contents of a website where Handala publicized its hacks, as well as another website that the group used to dox dozens of people over their alleged ties to the Israeli military and defense contractors, such as Elbit Systems and NSO Group, were replaced by a banner announcing the law enforcement action. 

The seizure announcement did not say why the FBI and the Justice Department took down the websites. But the language in them appears to indicate U.S. authorities believed these sites were run by hackers linked to a foreign government.

“Law enforcement authorities determined this domain was used to conduct, facilitate, or support malicious cyber activities on behalf of, or in coordination with, a foreign state actor,” read the seizure announcement. “The United States Government has taken control of this domain to disrupt ongoing malicious cyber operations and prevent further exploitation.”

Brian Bell, CEO of FusionAuth, has provided the following commentary: 

“The Stryker attack demonstrates that authentication and authorization are not the same thing. Attackers didn’t need to break in. They walked through the front door with compromised credentials. The missing safeguard is contextual: organizations need systems that can recognize when a privileged action is anomalous and require additional verification at that moment, not just at login. Risk-based, step-up authentication is a necessary architectural layer for organizations managing sensitive infrastructure, not just a ‘nice-to-have.’ The FBI’s seizure of Handala’s infrastructure is welcome – but the next group will find a new front door. The architectural fix has to happen on the defender’s side.”

I applaud this. Actions like this won’t stop these groups, but it will make their lives a bit more miserable. But it would be better if organizations defended themselves so things do not escalate to this level.

The FBI has warned Americans of cybercriminals impersonating health fraud investigators to steal their sensitive information.

The Federal Bureau of Investigation (FBI) warns the public about criminals impersonating legitimate health insurers and their investigative team members. These criminals are sending emails and text messages to patients and health care providers, disguising them as legitimate communications from trusted health care authorities. The messages are designed to pressure victims into disclosing protected health information, medical records, personal financial details, or providing reimbursements for alleged service overpayments or non-covered services.

Commenting on this news is Erich Kron, Security Awareness Advocate at KnowBe4: 

“This tactic uses the authority of large insurers, or the threat of investigative team members to create a strong emotional response to their messages. Whether it’s fear of having made an error, or the happy feeling of hearing that you had overpaid and will be refunded, the manipulation of our emotions is their primary goal. Humans tend to make bad decisions when in a heightened emotional state, something that these attackers are looking to exploit. If you’re being told you’re getting money back for something, you’re likely to get excited and be willing to provide a credit card or bank account information for the “refund” or provide more information under the guise of confirming your identity. This tactic can be used to collect sensitive information such as Social Security numbers, physical addresses, email addresses, phone numbers, or much more, all of which can be sold on the dark web.”

“People should always be aware of their emotional state, and should train themselves to use a strong emotional response as a trigger to take a deep breath and look at things very clearly. This is where you’re liable to find out that email addresses don’t come from reputable sources, websites in links look odd, or any number of other things that could clue you into something being amiss.”

Remember, if someone is trying to pressure you into to something or use fear to get you to do something, you are likely dealing with a scammer. Which means you should run quickly in the other direction. Then you should report it to the authorities so that they can do their best to go after the perpetrators. That way, everyone is a tiny bit safer.

Cybercriminals will have to find a new place to brag about who they’ve pwned and facilitate the sale of data that they’ve swiped. Because BreachForums which is a well known site for doing both has itself been pwned by the FBI:

The seizure occurred on Wednesday morning, soon after the site was used last week to leak data stolen from a Europol law enforcement portal.

The website is now displaying a message stating that the FBI has taken control over it and the backend data, indicating that law enforcement seized both the site’s servers and domains.

“This website has been taken down by the FBI and DOJ with assistance from international partners,” reads the seizure message.

“We are reviewing this site’s backend data. If you have information to report about cyber criminal activity on BreachForums, please contact us,” continues the seizure banner.

The seizure message also shows the two forum profile pictures of the site’s administrators, Baphomet and ShinyHunters, overlaid with prison bars.

If law enforcement has gained access to the hacking forum’s backend data, as they claim, they would have email addresses, IP addresses, and private messages that could expose members and be used in law enforcement investigations.

But it doesn’t end there. The FBI also pwned the following:

The FBI has also seized the site’s Telegram channel, with law enforcement sending messages stating it is under their control.

It also appears that Baphomet who is one of the people who ran the site might have been arrested. I can’t confirm that at present. But I am sure further details will come out about this. But this is as I like to say, a non trivial event. While I am sure that something like BreachForums will pop up to fill this void, the fact that this site was taken down by the FBI is sure to send shockwaves through the hacking community.

Watch this space as I expect more details to appear shortly.

UPDATE: Tom Marsland, VP of Technology, Cloud Range, and Board Chairman of VetSec had this comment:

“For the second time, US and international law enforcement groups worked together to seize BreachForums, a popular data leak site. Just like with the collaboration between Microsoft, CISA, the FBI, and the NSA, this joint effort shows the importance of public and private sectors working together to secure the cyber domain.  While the information surrounding this seizure is new at this point, it is exciting to see continued efforts to thwart this activity. Inevitably, these actors will show up again in another place, as they did when RaidForums was seized in 2022, but cyber defenders seem ready and poised to seize assets again if they do.”