Microsoft 365 Security Threat: Social Engineering via Personal Phone Calls
Attackers are leveraging personal phone lines to infiltrate Microsoft 365 environments through social engineering tactics that mimic internal IT communications.
Microsoft’s Identification of the Campaign
Microsoft Security Research identified the campaign in May 2026, noting that the initial compromise often leaves minimal digital traces due to the unmanaged nature of personal phones.
Attack Methodology
Initial Compromise
Investigators rely on employee recollections of suspicious calls or messages as the primary evidence in affected cases.
Fabricated Urgency and Spoofed Pages
The attack begins with a fabricated urgency, where perpetrators claim immediate action is required to update passkey, multifactor authentication (MFA), or single sign-on (SSO) configurations. Victims receive links directing them to spoofed Microsoft sign-in pages designed to mimic legitimate interfaces.
Adversary-in-the-Middle (AiTM) Phishing
Microsoft highlighted that while passkey-related lures are common, the true objective often involves AiTM phishing or device-code authentication flows.
Reconnaissance and Persistence
Targeted Reconnaissance
Attackers conduct reconnaissance using publicly available information from professional networks to tailor their approaches, sometimes reusing compromised accounts to send identical phishing messages through Microsoft Teams.
Persistent Access Mechanism
Once access is obtained, threat actors prioritize maintaining persistent presence within the compromised environment. Microsoft describes this as a durable persistence mechanism, where adversaries retain access even after initial authentication tokens expire.
Detection and Data Exfiltration
Microsoft Graph Exploitation
This is achieved through continuous exploitation of Microsoft Graph, the API framework connecting user data, files, mail, and permissions across Microsoft 365. Attackers use Graph to map organizational structures, identify administrative roles, and escalate privileges.
Stealthy Data Exfiltration
Data exfiltration occurs at a measured pace, with attackers accessing files and emails in volumes that remain below typical usage thresholds. Microsoft observed sustained activity levels, with some intrusions involving thousands of files or messages over extended periods.
Threat Groups and Mitigation Strategies
Linked Threat Groups
Microsoft Threat Intelligence linked the initial access phase to multiple threat groups, including Storm-3121 and Storm-3032. Storm-3121 is associated with ShinyHunters and Falcon extortion operations, while Storm-3032, originating from the BlackFile group, now operates under the Helix moniker.
Mitigation Recommendations
Mitigation strategies include deploying phishing-resistant MFA via Conditional Access, enforcing admin approval for app consents, and requiring managed devices for access to critical services like Exchange, SharePoint, and privileged Graph applications.
Conclusion
The campaign underscores the evolving sophistication of cloud-based attacks, where traditional detection methods struggle to identify stealthy data extraction patterns. Organizations are advised to monitor Microsoft Graph activity for anomalies in query sequences and implement layered defenses to counter social engineering vectors targeting personal communication channels.
About Author
English