Microsoft Knocked Out a Major Phishing Tool Marketplace. Your 365 Settings Still Need Attention.
Microsoft just took down a major phishing tool marketplace that was supplying criminals with kits to target US businesses. That is good news. One less big operation out there means slightly safer inboxes for all of us.
But I want to be honest with you: something like this gets replaced fast. Phishing kits are the kind of thing that AI is just going to make easier to spin up anyway. So while I appreciate Microsoft going after these people, I would not relax your guard based on this alone.
The Threat These Tools Were Built to Exploit
These kits were designed to target Microsoft 365, the same platform most of you are running right now. The way this attack works is not complicated. You get an email that looks like it came from your boss, or a colleague, or a vendor. It says something like, hey, change where you’re sending that payment. And because it looks like it came from inside your own system, people trust it.
One US investment firm lost $1.5 million from a single email. One wire transfer. Gone. And these are people who should absolutely know better. If it can happen to them, it can happen to a 10-person service business or a small manufacturer who is just trying to get through the week.
The Real Problem Is Default Settings and Untrained People
A lot of small businesses are running Microsoft 365 with the default security settings, and the defaults are not good enough. That is not Microsoft shaming, that is just reality. The platform has the tools. Most people just never turn them on.
And then there is the human side. This is not purely a technical problem. Your team has to know what a phishing email looks like. They have to know that if something feels off about a payment request or a change in instructions, they pick up the phone and verify it in person. Do not trust an email. Do not even trust a camera, because those can be faked too.
What to Actually Do About This
Start here, right now, before anything else:
- Turn on multi-factor authentication for every Microsoft 365 account in your business. If you do not have that on, you are at serious risk. Full stop.
- Talk to your IT provider about whether your 365 environment is configured correctly. There are settings outside the Microsoft defaults that make a real difference.
- Train your team to recognize phishing emails. This does not have to be complicated, but it has to happen.
- If you are in financial services or any regulated industry, some of this is not optional. There are standards you are required to meet, and ignoring them creates legal exposure on top of the financial risk.
You are not going to be perfect. Nobody is. Because it is a human problem as much as a technical one. But getting the basics right closes the door on a lot of these attacks before they ever get close to your bank account.
Questions about how this affects your setup? Schedule a free IT consultation and we’ll walk through it with you.
Wherever your team is based, ACS provides hands-on managed IT support — see how we help businesses in Central Florida.