S11E14 – Stolen 365 Tokens and Real Security Spending

Episode Summary

Mike started with a follow-up to the previous week’s AI discussion, saying most people use AI too softly and that he has spent about a year and a half building his own software for his business instead of renting tools. He also said his office will not use AI to answer phones or chat on the website.

The core of the show was a real incident: a business client’s Microsoft 365 account was taken over through a SharePoint-style link that stole a sign-in token, and the attackers tried to redirect payments before Mike’s team caught it. That led into a talk on why viruses are rarely the real threat, how scams work, and why home users should spend less on antivirus while businesses with regulated data should spend more. One caller joined near the end.

Topics Covered

Building your own tools with AI

Mike said many people only chat with AI, while he uses it to build software that fits how he works, saving the per-computer rental fees he pays for other tools. He said the phrase ‘I can’t do that’ is disappearing from his conversations with customers. He added that AI is good behind the scenes but that he does not want it answering the phone or sitting in a website chat bubble.

Token theft in Microsoft 365

Mike explained a newer attack where visiting a shared-file link steals a user’s authentication token, so the attacker never needs a password or two-factor code. He said the page just reports that the file is missing while the attacker, who may wait for days, logs in, sets up mailbox rules and writes to the victim’s contacts. He described a client case where attackers impersonated an accountant to ask paying agencies to change bank details, and his team undeleted the hidden messages, got the client to call the agencies, and stopped about $300,000 in transactions. He advised paying for a business Microsoft 365 plan with security tools and said his firm offers free security audits to businesses.

Viruses versus scams

Mike said traditional viruses have not been the main problem for roughly ten years. The common attacks are fake virus pop-ups that scare people into calling tech support, follow-up refund scams, romance scams aimed at older people, and fake family-in-jail calls that may use cloned voices. He said Macs and PCs have similar infection rates per person and that Mac users tend to be overconfident.

Who should spend on security

Mike said home users should drop paid antivirus like Norton or McAfee and rely on built-in Windows and Mac protection plus backups and cloud storage. He said businesses handling regulated or sensitive data, such as HIPAA or card data, should spend much more, and said he found about 9,000 stored card numbers in a client’s website database during a test. He said most small medical offices he audits are not HIPAA compliant.

Calls

• A caller, unnamed in the transcript, said regular people should get some kind of awareness training since antivirus will not stop phishing. Mike agreed, advised treating everything on screen as fake until verified, and mentioned his firm offers month-long phishing simulations with a report.