Radiant Resources Inc

🚨 New FBI alert: a phishing kit called "Kali365" is breaking into Microsoft 365 accounts — without ever stealing a password.

Here's how it works:
→ You get an email that looks like it's from DocuSign, SharePoint, or OneDrive
→ It asks you to enter a short code on a real Microsoft sign-in page
→ That single step hands an attacker a token that gives them ongoing access to your Outlook, Teams, and OneDrive — no password, no MFA prompt needed

Because the page is genuinely Microsoft's, most security tools don't flag it. And victims often don't realize anything happened until weeks later.

At Radiant Resources, we believe the strongest firewall is an informed team. A few things every organization should do right now:
✅ Lock down or restrict device code sign-in flows where possible
✅ Train employees to never approve a sign-in code they didn't request
✅ Review connected devices and active sessions regularly
✅ Watch for unusual inbox rules or login activity

Threats are evolving. So should we.
📖 Full story on how Kali365 works (and the FBI's official recommendations) is linked in the comments below.

Rain's calling the shots tonight — Songwriters on the Beach in Bradley Beach is canceled. The season's just getting started, though, and we'll see you on the sand next Thursday. Full lineup at SongwritersOnTheBeach.com.

⏱️ 60 seconds.

That's the median time it takes for a user to click a phishing link and enter their information.

Not 60 minutes.
Not 10 minutes.
Just 1 minute.

Cyberattacks don't happen because organizations lack technology—they often happen because someone makes a split-second decision.

The best defense? Ongoing employee education, phishing awareness training, and creating a culture where people know what to look for before clicking.

When it comes to cybersecurity, every second matters.