Phishing and stolen credentials are now the leading way ransomware gets in. In Sophos's 2026 State of Ransomware survey of more than 2,000 organizations, 79% of attacks started with an identity-based attack such as a malicious email, a phishing page or a compromised login. The FBI warns that the Kali365 platform is actively targeting Microsoft 365 users with fake login pages, and Floridians have reported more than $12 million in phishing losses, up from roughly $4 million the year before.
Small business owners face mounting cyber threats as the FBI warns about the Kali365 phishing platform targeting Microsoft 365 users, as Floridians report more than $12 million in phishing losses, up from roughly $4 million the year before. These sophisticated attacks use fake login pages nearly identical to Microsoft's legitimate site.
In a major shift, Sophos found that exploited vulnerabilities are no longer the top root cause of ransomware: malicious email (26%), phishing (24%) and compromised credentials (23%) now lead, with vulnerabilities at 18%. That makes phishing and stolen logins the top risks for businesses.
Microsoft released its largest-ever Patch Tuesday update with 622 security fixes, including three actively exploited zero-days affecting BitLocker, SharePoint, and Active Directory. Immediate patching is critical for all Microsoft environments.
The NSA also issued warnings about Russian-backed hackers exploiting poorly configured routers. Simple security measures like changing default passwords, updating firmware, and restricting remote management can effectively block these attacks.
The key takeaway: Basic security hygiene and strong credential management are now more important than ever for protecting small businesses.
Why phishing training and credential attacks matter most to your business
Compromised credentials have surpassed software vulnerabilities as the leading ransomware attack vector. Sophos found that 79% of ransomware attacks now start with an identity-based attack: a malicious email, a phishing page, or a stolen login. The Kali365 phishing platform uses fake Microsoft 365 login pages nearly identical to the real sites, tricking employees into handing over access. Microsoft's July 2026 Patch Tuesday included 622 fixes with three actively exploited zero-days in BitLocker, SharePoint, and Active Directory. For manufacturers and professional services firms in Connecticut, the immediate action is clear: deploy MFA across all Microsoft accounts, apply patches within 48 hours, and run phishing awareness training showing staff how to spot fake login pages. CISA recommends staff verify login URLs and enable security features before clicking any links in email.
Key takeaways
- 79% of ransomware attacks start with phishing, malicious email, or stolen credentials (Sophos, 2026).
- Microsoft's 622 July patches must be applied immediately; three zero-days are actively exploited in production systems.
- MFA blocks 99.9% of credential-based attacks; it is the single most cost-effective control for small businesses.
- Kali365 targets Microsoft 365 users with near-perfect fake login pages; staff training on URL verification prevents most breaches.
Frequently asked questions
What is the Kali365 phishing platform and who does it target?
Kali365 is an active phishing service that mimics Microsoft 365 login pages with near-perfect accuracy. It tricks employees into entering their credentials, and the FBI says it can capture access tokens to get past multifactor authentication. It targets small and mid-size businesses across all industries.
How do I know if my team needs phishing training?
If your business uses Microsoft 365 and has not run phishing simulations in the past 6 months, training is overdue. Staff should be able to identify fake login pages, verify sender addresses, and know when to report suspicious emails to your IT team or MSP.
Which Microsoft patches should I apply first?
Prioritize patches for the three actively exploited zero-days: BitLocker, SharePoint, and Active Directory. Apply all 622 patches within 48 hours to critical systems. Your MSP can automate this process and verify completion across all devices.
Is multi-factor authentication (MFA) really necessary for small businesses?
Yes. Microsoft has reported that MFA blocks more than 99.9% of automated account-compromise attacks. It isn't bulletproof: in Sophos's 2026 survey, MFA was in place in 97% of incidents where stolen credentials were the root cause, so pair it with phishing-resistant sign-in methods. At a small cost per user per month, MFA is the highest-return security investment you can make, especially for cloud services like Microsoft 365.
Sources
- https://www.news4jax.com/news/local/2026/07/15/fbi-warns-kali365-phishing-platform-is-targeting-microsoft-365-users-floridians-report-12-million-in-losses
- https://www.infosecurity-magazine.com/news/compromised-logins-ransomware-entry/
- https://www.malwarebytes.com/blog/bugs/2026/07/july-2026-patch-tuesday-fixes-622-microsoft-cves-including-three-zero-days
- https://www.foxbusiness.com/fox-news-tech/russian-hackers-exploiting-vulnerable-internet-routers-nsa
Keep reading
Source: FBI warns Kali365 phishing platform is targeting Microsoft 365 users (News4Jax)
Source: Sophos: The State of Ransomware 2026
Produced with AI from TC3's daily cyber briefing video. Not individually reviewed before publishing; questions go to a human at [email protected].