FBI Warns of Kali365 Phishing Service Targeting Microsoft 365 Account

Feed of security incidents and research: FBI warns of Kali365, a phishing-as-a-service that can bypass MFA to hijack Microsoft 365 accounts; SafeDep reports the Megalodon supply-chain attack that injected malicious CI workflows into 5,561 GitHub repos to steal cloud credentials; researchers found deleted Google API keys remain active up to 23 minutes exposing GCP/Gemini/BigQuery/Maps data; Europol seized First VPN used by ransomware groups and arrested its administrator; Android malware covertly subscribes victims to premium services; attackers are abusing MSHTA for fileless Windows malware; a