Microsoft 365 phishing is getting smarter: what UK SMEs should check now

Microsoft 365 has become the working centre of many small and medium-sized businesses. Email, Teams, OneDrive, SharePoint, calendars, files and customer conversations often sit inside the same environment. That makes it incredibly useful, but it also makes Microsoft 365 a valuable target.

A recent warning reported by ITPro highlights a phishing-as-a-service platform called Kali365, which the FBI says can help attackers gain access to Microsoft 365 accounts by capturing OAuth access tokens rather than simply stealing a username and password. In practical terms, this type of attack can work around the way many people think multi-factor authentication protects them.

That does not mean MFA is broken or pointless. MFA remains one of the most important security controls a business can use. But it does mean SMEs should avoid treating MFA as the final line of defence. Microsoft 365 security depends on a wider set of controls, including conditional access, sign-in monitoring, device policies, app permissions and user awareness.

This warning lands at the same time as a broader UK cyber security message from GCHQ. In her inaugural annual lecture at Bletchley Park, GCHQ Director Anne Keast-Butler warned that the UK is facing a more uncertain threat environment, with cyber security needing to become “ten times more urgent” from “living rooms to boardrooms”. For SMEs, the useful takeaway is not panic. It is that cyber security now belongs in normal business planning, alongside finance, operations, insurance, continuity and customer service.

There has also been a fresh reminder that known software vulnerabilities remain a live risk. SecurityWeek reported that a critical FortiClient Endpoint Management Server vulnerability, patched earlier this year, has been exploited in fresh attacks. That story is relevant even for businesses that do not use FortiClient EMS, because the principle is wider: security tools, remote access systems and endpoint management platforms can become high-value targets if they are not patched and monitored properly.

Taken together, these stories point to a clear lesson for UK SMEs. Attackers are not relying on one simple route in. They are using phishing platforms, cloud access tokens, legitimate login pages, remote management tools and unpatched systems. A business does not need a large internal IT team to respond, but it does need a practical security baseline that is actively managed.

Why Microsoft 365 is such a common target

For most SMEs, Microsoft 365 is more than email. It contains sensitive documents, invoices, HR files, customer records, Teams conversations and access to other systems. If an attacker gets into one account, they may be able to read mail, impersonate staff, reset passwords, access files, set up forwarding rules or use the account to target colleagues and suppliers.

That is why Microsoft 365 phishing has moved beyond crude fake login pages. Attackers increasingly try to abuse legitimate authentication processes, persuade users to authorise access, or capture tokens that allow them to remain signed in. The user may believe they have completed a normal Microsoft step, especially if the page looks familiar and the request appears to come from a known productivity or document-sharing service.

For a small business, the damage can be immediate. A compromised mailbox can lead to invoice fraud, data exposure, supplier impersonation, customer trust issues and operational disruption. Even when no money is stolen, the time spent investigating, resetting access, checking mail rules and reassuring customers can be significant.

MFA is essential, but configuration matters

Many SMEs have rightly enabled MFA. That is a good start, but Microsoft 365 security should not stop there.

A stronger setup normally includes conditional access rules that limit risky sign-ins, policies that restrict unnecessary authentication flows, controls over which apps can request access, and alerts for suspicious activity. Businesses should also review emergency access accounts, administrator roles and legacy authentication settings.

The Kali365 reporting is particularly useful because it highlights device code phishing. In this type of attack, a user may be asked to enter a code into a legitimate Microsoft page. The problem is that they may be authorising the attacker’s session, not their own. That means user training should go beyond “check the link” advice. Staff need to know that unexpected sign-in codes, document access requests and authentication prompts should be treated carefully, even when the page itself appears genuine.

Patching is still a business-critical habit

The FortiClient EMS story is a reminder that patching is not just a technical housekeeping task. Endpoint management tools, VPN systems, firewalls and remote access platforms often sit close to the heart of the business network. If they are exposed or unpatched, they can provide attackers with a powerful route in.

For SMEs, the challenge is rarely a lack of awareness. It is usually capacity. Someone has to know which systems are in use, which versions are installed, which patches matter, whether the patch has applied successfully, and whether there are signs of compromise. That is difficult to maintain informally, especially as hybrid working, cloud services and remote support tools multiply.

A practical approach starts with an accurate asset list. If a business does not know what it runs, it cannot reliably secure it. From there, patching should be prioritised around internet-facing services, security products, remote access tools, operating systems and widely used applications.

What UK SMEs should do now

The right response is not to rush into a long shopping list of tools. It is to check whether the basics are being done well.

First, review Microsoft 365 sign-in security. Check whether MFA is enabled for all users, whether administrators have stronger controls, whether conditional access is in place, and whether risky sign-ins are being monitored.

Second, review authentication methods. If device code flow or other less common methods are not needed, consider restricting them. Where exceptions are required, document them and monitor them.

Third, check app permissions. Attackers do not always need a password if they can persuade someone to authorise a malicious or unnecessary app. Review OAuth permissions and remove anything that is not trusted or required.

Fourth, audit patching for key systems. This should include endpoint security tools, VPNs, firewalls, remote management tools, servers and business-critical applications.

Fifth, test recovery. If an account is compromised or ransomware spreads, the business needs clean backups, clear responsibilities and a tested recovery plan. Backups that have never been restored should not be treated as proven.

Finally, keep staff guidance practical. People do not need a lecture full of technical terms. They need clear examples of suspicious prompts, unexpected codes, unusual document requests and when to ask for help.

A practical Comtek view

For SMEs, the aim is not perfect security. The aim is reducing the most likely and most damaging risks in a way the business can actually sustain.

That usually means getting Microsoft 365 configured properly, keeping systems patched, monitoring for suspicious activity, protecting endpoints, backing up business data and making sure staff know what to do when something feels wrong.

The latest Microsoft 365 phishing warning, GCHQ’s wider cyber message and the FortiClient vulnerability reports all point in the same direction: cyber resilience is now part of everyday business resilience. It affects email, files, phones, payments, customer service and reputation.

Need advice on how this affects your business? Contact Comtek.