digiWEST Security Update: July 2026

Over the last few months, the most consistent pattern across North American cyber incidents was not hackers “breaking in,” but rather hackers logging in. Across breaches affecting telecommunications companies, universities, healthcare systems, and technology platforms, attackers repeatedly entered through stolen credentials, piggybacked on trusted app connections, or tricked employees into handing over access. In the most notable cases, no firewall was defeated and no vulnerability was exploited. A phishing email, a reused password, or a third-party app permission was all it took.

For small and medium-sized businesses, this shift matters enormously. Many SMBs invest in antivirus software and firewalls but have not updated how they think about identity: who has access to what, which apps connect to employee accounts, and whether staff can recognize a login page designed to steal their credentials. As attackers increasingly use AI-powered tools to make phishing emails look legitimate and automate credential theft at scale, the gap between organizations with strong identity hygiene and those without is growing fast.

FBI Warns: Hackers Using PhaaS Platform to Bypass MFA and Access Microsoft 365 Environments

The FBI recently issued a warning about the Kali365 phishing-as-a-service (PhaaS) platform, which facilitates Microsoft 365 account hijacking by abusing OAuth device code authentication and adversary-in-the-middle (AitM) proxying.

Key Takeaways

• These methods bypass multi-factor authentication (MFA) to steal session tokens, granting unauthorized access to cloud environments, enabling data theft, and allowing the persistence of malicious inbox rules and device registrations.
• The campaigns primarily targeted Microsoft 365 environments using phishing emails impersonating trusted cloud productivity and document sharing services that directed victims to Microsoft’s device code login portal, where they unknowingly authorized attackers to access their Microsoft 365 accounts and various services, including Teams, Outlook and OneDrive.

Ransomware by Landscape: Most Active Groups

Ransomware Spotlight: Akira

How they get in: Akira frequently partners with Initial Access Brokers, which are criminals who specialize in selling pre-obtained VPN and network credentials. This lets them skip the initial intrusion step entirely and go straight to spreading through a victim’s systems.

What they do once inside: Akira is known for rapid movement. Once credentials are secured, the group can encrypt a large network within hours. In some sectors, including financial services, Akira has shifted toward data theft and extortion rather than encryption — particularly exploiting ‘Shadow AI,’ where employees use unauthorized AI tools that inadvertently expose configuration data or credentials.

Who they are targeting in North America right now: Financial services, manufacturing, and technology companies, with a growing focus on mid-sized firms with less mature security programs.

Company Size Target Profile

Small and medium-sized businesses remain the most frequently targeted in North America. While ransomware groups most often set sights on smaller businesses, the impact rarely stays contained — shared vendors, platforms, and service providers mean a breach at one company can ripple across its entire network of partners and clients.

digiWEST System and Operations Practices

• Develop a “security first” culture: We provide both penetration testing and vulnerability scanning at least yearly to all contracted clients to prioritize patching for internet-facing systems, identity infrastructure, SaaS platforms, VPNs, cloud control planes, and critical operational technology, where newly discovered flaws are most likely to be exploited quickly.
• Harden help desk and social engineering defenses: We implement strict identity verification protocols before any credentials are issued or reset over phone or chat, and limit how much data any single customer-facing system can expose to reduce the blast radius of a successful social engineering attempt.
• Focus on identity and credential hygiene: We maintain a password rotation for CI/CD secrets, API keys, and OAuth tokens on a regular schedule and immediately after any third-party tool compromise is disclosed. We treat app permissions with the same rigor as user accounts, auditing and removing unused OAuth authorizations across SaaS platforms regularly.
• Strengthen identity and SaaS hygiene: We ensure patching and remediation efforts extend to SaaS configurations, identity providers, OAuth applications, and cloud management tools, which are often updated outside traditional IT processes.