Introduction: The Login That Wasn’t Yours
For years, the advice to small and medium-sized businesses was simple: turn on multi-factor authentication and you’ve stopped the vast majority of account attacks. That advice was true — and it’s now dangerously incomplete.
In 2026, the fastest-growing threat to Canadian businesses doesn’t crack passwords or brute-force its way through your firewall. It politely asks an employee to log in — on a pixel-perfect fake Microsoft 365 page — and then steals the session token that Microsoft issues after a successful sign-in. Password entered, MFA code approved, box checked. Except the attacker now holds a digital hall pass into your email, Teams, SharePoint, and OneDrive, and your MFA never gets asked again.
This technique is called adversary-in-the-middle (AiTM) phishing, and it has moved from nation-state tradecraft to a subscription product any criminal can rent. This month, the FBI warned about Kali365, a phishing-as-a-service platform built specifically to steal Microsoft 365 session tokens. Closer to home, Microsoft has attributed the Storm-2755 operation to campaigns that deliberately geo-target Canadian users, and the Canadian Centre for Cyber Security has tracked more than 100 AiTM campaigns aimed at Canadian Microsoft 365 environments.
If your business runs on Microsoft 365 — and most Canadian SMBs do — this is the threat to understand this year.
Section 1: The Threat — Identity Is the New Perimeter, and It’s Under Siege
The numbers tell a consistent story: attackers have shifted from breaking systems to impersonating people.
According to Sophos’s 2026 research, 71% of organizations suffered an identity-related breach in the past year, and identity attacks were the root cause of 67% of investigated incidents — now surpassing ransomware itself as the leading entry point. In fact, among ransomware victims, two-thirds traced the original break-in back to a compromised identity.
The financial stakes for Canadian organizations are severe. IBM’s latest research puts the average cost of a Canadian data breach at $6.98 million, up more than 10% year-over-year — and breaches that begin with phishing cost even more, averaging $7.91 million. For an SMB, even a small fraction of those figures — emergency incident response, downtime, legal notification obligations, lost customer trust — can be existential. CIRA’s survey data shows 43% of Canadian organizations experienced an attack in the past 12 months.
And the attacks are getting better, fast. AI-generated phishing emails are roughly three times more effective than traditional campaigns — flawless English and French, convincing corporate tone, and personal details scraped from LinkedIn and your own website. The tell-tale typos your team was trained to spot are gone.
Section 2: What Canadian Businesses Need to Know
Three developments make this a board-level conversation for Canadian SMBs right now — not just an IT ticket.
1. Your current MFA probably isn’t “phishing-resistant.” SMS codes, authenticator-app codes, and push approvals all share a weakness: they can be relayed in real time by an AiTM phishing page. The employee thinks they’re approving their own login; they’re actually approving the attacker’s. By contrast, FIDO2 security keys and passkeys block over 99% of identity attacks, according to Microsoft, because they’re cryptographically bound to the real website — a fake page simply can’t complete the handshake. Microsoft is acting on this: starting September 1, 2026, passkeys become the default sign-in experience for Microsoft 365 users currently relying on SMS or voice codes.
2. Regulation is pushing security downstream to you. Bill C-8, which received Royal Assent on June 15, 2026, imposes cybersecurity obligations on federally regulated sectors — finance, energy, telecom, and transport. Here’s why that matters even if you’re a 20-person firm: those regulated organizations are now writing their obligations into supplier contracts. Canadian SMBs are already seeing requirements for 72-hour incident notification, documented incident response plans, and MFA attestations appear in vendor agreements and renewal paperwork. Add existing obligations under PIPEDA (mandatory breach reporting) and Quebec’s Law 25 (if you hold data on Quebec residents), and “we’ll get to security later” is no longer a defensible position.
3. Privacy law makes a stolen mailbox a reportable event. A compromised email account isn’t just an IT nuisance — it’s typically a privacy breach. Under PIPEDA, a breach creating a real risk of significant harm must be reported to the Privacy Commissioner and affected individuals. Law 25 carries penalties that can reach into the millions for Quebec-linked data. The cost of one stolen session token can therefore extend far beyond the inbox.
Section 3: Five Moves That Close the Gap
Here’s the practical, prioritized checklist we recommend to every Canadian SMB this quarter:
- Upgrade to phishing-resistant MFA for high-risk accounts first. Roll out passkeys or FIDO2 security keys for admins, executives, and finance staff — the accounts attackers target for payment fraud. Extend to all users as Microsoft’s September passkey rollout lands.
- Turn on the protection you already pay for. Microsoft recently included Defender for Office 365 Plan 1 (with Safe Links time-of-click URL protection) in Business Basic and Business Standard plans. Many tenants have never enabled it. Verify your Safe Links and Safe Attachments policies cover every user.
- Use Conditional Access to make stolen tokens worthless. Policies that require compliant, managed devices — and that evaluate sign-in risk continuously — can block a session token replayed from an attacker’s machine, even if the phish succeeds.
- Verify your backups, don’t just run them. Identity compromise is the leading path to ransomware. Ensure both your servers and your Microsoft 365 data (email, SharePoint, OneDrive) are backed up independently, and test a restore quarterly. Microsoft’s native retention is not a backup.
- Write down your incident response plan — and your 72-hour clock. With Bill C-8 requirements flowing into supply chains and PIPEDA’s reporting rules, know in advance who you call, what you isolate, and how you notify. An IR plan drafted during a crisis is not a plan.
Key takeaway: MFA was step one. Phishing-resistant sign-in, hardened Microsoft 365 configuration, verified backups, and a rehearsed response plan are what “secure” looks like in 2026.
Section 4: How System Support Canada Helps
Most SMBs don’t have the time — or the in-house specialists — to redesign authentication, audit tenant policies, and stand up compliant incident response. That’s exactly the gap we fill.
System Support Canada has spent 15+ years as the outsourced IT department for 80+ Canadian businesses, delivering 24/7/365 helpdesk support at a fixed monthly price — so security improvements never come with surprise invoices. As part of our managed services, our Toronto-based team handles Microsoft 365 and cloud management (including Conditional Access, Safe Links, and passkey rollout), independent backup for your servers and Microsoft 365 data, and unlimited helpdesk support so your staff always has a real human to call when a suspicious email lands.
We don’t sell fear — we build quiet confidence that your business will still be running tomorrow morning.
Conclusion: Get Ahead of the September Shift
Microsoft’s move to passkeys, the FBI’s Kali365 warning, and Bill C-8’s ripple effects all point in the same direction: the businesses that modernize identity security now will barely notice this threat wave. The ones that don’t will be the case studies.
Start with a free, no-obligation IT assessment. We’ll review your Microsoft 365 security posture, check whether token-theft protections are in place, verify your backup coverage, and give you a plain-English report you can act on — whether you work with us or not.
👉 Book Your Free IT Assessment or call +1 416-987-1014.
