Vishing-Led Microsoft 365 Intrusion Pivoted Across SaaS Apps, Exporting 2,500 ServiceNow User Records
Summary
A Sophos investigation traced a vishing-enabled password reset to a Microsoft 365 takeover, nearly 100,000 SharePoint downloads, and a confirmed ServiceNow export of about 2,500 user records.
Key points
- The attacker impersonated help desk staff and persuaded a user to provide an SMS verification code, enabling a self-service password reset.
- After the reset, the attacker registered a Windows device and used a Primary Refresh Token-backed session to access Microsoft 365 and federated SaaS apps.
- Microsoft Graph queries were used to enumerate users, roles, service principals, tenant relationships, and other organizational details.
- Audit logs showed access to more than 100 mail items and downloads of approximately 100,000 SharePoint files; the attacker also deleted a vishing-warning email.
- ServiceNow logs confirmed an export of approximately 2,500 sys_user records. The attacker browsed a computer-inventory view, but investigators found no evidence it was exported.
- Salesforce detected suspicious activity, froze the account, and notified the administrator. Teams was launched, but passive viewing of existing chats and channels is not audited in the described logs.
- Recommendations include strengthening account recovery, monitoring device registration after password resets, revoking sessions across federated apps, and hunting for post-compromise reconnaissance and bulk exports.
Article Details
- Attack Vectors
- The actor impersonated help desk personnel in a vishing call and persuaded a user to provide the SMS verification code for an SSPR password reset.
- After resetting the password, the actor registered a new Windows device and used a Primary Refresh Token-backed session to access Microsoft 365 and federated SaaS applications.
- The actor used Microsoft Graph for reconnaissance, accessed email and SharePoint files, and pivoted through federated sign-in to Salesforce and ServiceNow.
- The actor exported the ServiceNow sys_user table, producing a CSV containing approximately 2,500 records.
- Defensive Notes
- Harden SSPR: prioritize phishing-resistant recovery factors, tightly scope any retained SMS verification, and monitor anomalous reset activity.
- Treat device registration as privileged: require MFA, alert on registration soon after a password reset or anomalous sign-in, and verify the user's identity and device ownership.
- For containment, revoke active sessions and refresh tokens across the identity provider and federated SaaS platforms, not just reset the password.
- Monitor Graph API directory, role, and service-principal enumeration; SharePoint searches for credentials or sensitive data; unusual mailbox access followed by message deletion; and bulk SaaS exports.
- Add ServiceNow sys_user and cmdb_ci_computer activity to detection coverage, and validate automated containment for federated SaaS applications.
MITRE ATT&CK
T1070.008 · Clear Mailbox DataThe actor deleted a vishing-awareness email and one other message from the compromised mailbox.T1078 · Valid AccountsThe actor used the compromised user's account to access Microsoft 365 and federated SaaS applications.T1083 · File and Directory DiscoveryThe actor searched SharePoint for terms related to credentials, customer information, and organizational data.T1087.004 · Cloud AccountThe actor used Microsoft Graph queries to enumerate users, directory roles, and service principals.T1098.005 · Device RegistrationThe actor registered a new Windows device to the compromised Entra ID identity.T1114.002 · Remote Email CollectionMailItemsAccessed records showed access to messages in the compromised user's mailbox and shared mailboxes.T1213.002 · SharepointThe actor downloaded approximately 100,000 unique SharePoint files.T1552.001 · Credentials In FilesThe actor searched SharePoint for credential-related terms including password, cred, ssh, aws, and vpn.T1567 · Exfiltration Over Web ServiceThe actor downloaded SharePoint data and exported the ServiceNow sys_user table through SaaS platforms.T1656 · ImpersonationThe actor impersonated help desk personnel during a vishing call to obtain the user's SMS verification code.
People
Vendors
Microsoftthreat actor used voice phishing (vishing) and self-service password reset (SSPR) abuse to take over a Microsoft 365 account, establish a Primary Refresh Token (PRT)-backed device session, and pivot into multiple SaaSSalesforceaccess to email and SharePoint content including the download of nearly 100,000 documents, access to Salesforce, and a confirmed user-table export from ServiceNow of approximately 2,500 records. ServiceNowthe download of nearly 100,000 documents, access to Salesforce, and a confirmed user-table export from ServiceNow of approximately 2,500 records. SophosIn a recent case investigated by the Sophos X-Ops Incident Response team, a threat actor used voice phishing (vishing) and self-service password reset (SSPR) abuse to take over a Microsoft 365 account, establish a
Products
Entra IDEntra ID registration of a new Windows deviceMicrosoft 365 Apps for Enterpriseactor used voice phishing (vishing) and self-service password reset (SSPR) abuse to take over a Microsoft 365 account, establish a Primary Refresh Token (PRT)-backed device session, and pivot into multiple SaaSMicrosoft GraphPost-compromise activity was identified from a single compromised user account and included Microsoft Graph reconnaissance, access to email and SharePoint content including the download of nearly 100,000 documents,Microsoft SharePointfrom a single compromised user account and included Microsoft Graph reconnaissance, access to email and SharePoint content including the download of nearly 100,000 documents, access to Salesforce, and a confirmedMicrosoft TeamsLogs indicate the threat actor accessed emails, downloaded SharePoint documents, and launched Microsoft Teams. Microsoft Graph was used for initial reconnaissance, and over the course of the next day the actorSalesforceaccess to email and SharePoint content including the download of nearly 100,000 documents, access to Salesforce, and a confirmed user-table export from ServiceNow of approximately 2,500 records. ServiceNowthe download of nearly 100,000 documents, access to Salesforce, and a confirmed user-table export from ServiceNow of approximately 2,500 records. Sophos ITDRSophos ITDR flags tenants for which SMS, voice call, and email OTP remain enabled as authentication methods, and for which SSPR for non-admins accepts a single method. These checks push account recovery away fromSophos XDRSophos XDR alerts on “Unusual Login and File Download Behavior Detected from Single IP for a User,” correlating an anomalous login with mass SharePoint downloads from the same IP within one hour. A second alerting