Attackers Use Personal-Phone Calls to Take Over Microsoft 365 Accounts
Summary
Microsoft reports attackers impersonating IT staff by phone and text to steal Microsoft 365 access, add their own MFA methods, and quietly extract files and email through Microsoft Graph and cloud services.
Key points
- Tracked since May 2026, the campaign uses calls or texts to personal phones and passkey, MFA, or SSO update pretexts to direct employees to fake sign-in pages.
- Microsoft says the lures lead to adversary-in-the-middle phishing or device-code authentication; attackers also research targets and may use compromised accounts to approach coworkers.
- After gaining access, attackers register their own MFA method, allowing continued access after the initial stolen token or session expires.
- Microsoft observed attackers using Microsoft Graph to enumerate users, groups, roles, authentication methods, and applications before accessing mail and files.
- Data theft from SharePoint, OneDrive, and Exchange Online is sustained but paced below 1,000 files or emails per hour; the python-httpx user agent is one context-dependent indicator.
- Microsoft attributes initial access activity to actors including Storm-3121 and Storm-3032, and recommends phishing-resistant MFA, approval for new app consent, and managed-device requirements.
Article Details
- Attack Vectors
- Attackers call or text employees' personal phones while impersonating internal IT staff, using passkey, MFA, or SSO update pretexts to direct victims to Microsoft-lookalike sign-in pages.
- The campaign uses adversary-in-the-middle phishing or device-code authentication flows to obtain account access.
- Attackers gather employee and organizational information from public sources and may use compromised employee accounts to send lures to coworkers through Microsoft Teams.
- After compromising an account, attackers register their own phone number, authenticator app, or software-based one-time password token as an MFA method.
- Attackers use Microsoft Graph to enumerate tenant users, groups, admin roles, authentication methods, and connected applications, then access and download files and email through SharePoint Online, OneDrive for Business, and Exchange Online.
- Data collection is described as measured and sustained, with activity kept below 1,000 files or emails per hour.
- Defensive Notes
- Use phishing-resistant MFA through Conditional Access.
- Require admin approval for new app consent.
- Require managed devices before sign-in to Exchange, SharePoint, or privileged Graph applications.
- Assess Microsoft Graph activity holistically, correlating behavioral progression and cross-event activity rather than treating individual API requests in isolation.
- Do not treat the python-httpx user agent alone as malicious; assess it alongside data volume, affected identities, source infrastructure, reconnaissance, and evidence of identity compromise.
MITRE ATT&CK
T1078 · Valid AccountsAttackers reuse compromised employee accounts, including to send passkey-themed lures to coworkers through Microsoft Teams.T1098.005 · Device RegistrationAfter account compromise, attackers register their own phone number, authenticator app, or software-based one-time password token as an MFA method.T1114 · Email CollectionAttackers collect email from Exchange Online through REST APIs.T1213.002 · SharepointAttackers access and download files from SharePoint Online.T1213.005 · Messaging ApplicationsAttackers access and download files from OneDrive for Business.T1566.004 · Spearphishing VoiceAttackers use phone calls and text messages impersonating internal IT staff to deliver account-access lures.T1593 · Search Open Websites/DomainsBefore contacting employees, attackers gather staff and organizational details from public sources, including professional networking sites.
Threat Actors
BlackFileThe article says Storm-3032 grew out of the BlackFile group.FalconThe article says Storm-3121 feeds into Falcon extortion operations.HelixThe article says Storm-3032 operates its own extortion operation under the Helix name.ShinyHuntersThe article says Storm-3121 feeds into ShinyHunters extortion operations.Storm-3121Microsoft Threat Intelligence attributes initial access activity in the campaign to Storm-3121; the article says it feeds into ShinyHunters and Falcon extortion operations.UNC6671Microsoft Threat Intelligence attributes initial access activity in the campaign to Storm-3032; the article says it grew out of the BlackFile group and now operates an extortion operation under the Helix name.
Vendors
Products
Exchange OnlineMicrosoft 365 accounts, then quietly stealing files and email through SharePoint, OneDrive, Exchange Online, and Microsoft Graph.Microsoft 365 Apps for Enterpriseinternal IT staff over calls and texts to trick employees into giving access to corporate Microsoft 365 accounts, then quietly stealing files and email through SharePoint, OneDrive, Exchange Online, andMicrosoft Graphaccounts, then quietly stealing files and email through SharePoint, OneDrive, Exchange Online, and Microsoft Graph.Microsoft OneDriveaccess to corporate Microsoft 365 accounts, then quietly stealing files and email through SharePoint, OneDrive, Exchange Online, and Microsoft Graph.Microsoft SharePointinto giving access to corporate Microsoft 365 accounts, then quietly stealing files and email through SharePoint, OneDrive, Exchange Online, and Microsoft Graph.Microsoft TeamsIn some cases, they reuse an already compromised employee account to send the same passkey pitch to coworkers over Microsoft Teams, a tactic that increases the likelihood of engagement.