Attackers call employees’ personal phones to break into Microsoft 365 accounts
Microsoft tracks vishing campaigns by Storm-3121 and Storm-3032 that impersonate IT staff, phish Microsoft 365 credentials, and steal cloud data.
Microsoft Security Research has tracked a campaign since May 2026 in which attackers call or text employees' personal phones posing as IT staff, using passkey/MFA/SSO lures to run adversary-in-the-middle phishing or device-code authentication flows. Attackers register their own MFA methods for durable persistence, abuse Microsoft Graph for tenant discovery, and download SharePoint, OneDrive, and Exchange data below 1,000 files or emails per hour to avoid detection. Microsoft attributes initial access to actors including Storm-3121, which feeds ShinyHunters and Falcon extortion operations, and Storm-3032, the Helix extortion operation descended from BlackFile.
- Attackers impersonate IT on personal phones with passkey, MFA, or SSO lures leading to AiTM or device-code phishing.
- Persistence via attacker-registered MFA methods survives stolen token expiry and password resets.
- Microsoft Graph discovery and SharePoint/OneDrive/Exchange collection kept below 1,000 items per hour to avoid alarms.
- Attribution includes Storm-3121 (ShinyHunters/Falcon feed) and Storm-3032 (Helix extortion, from BlackFile).
- Defenses: phishing-resistant MFA, Conditional Access, app consent admin approval, managed-device requirements.
- ATT&CK
- T1566.002 Spearphishing LinkT1557.002 Adversary-in-the-MiddleT1098.001 Additional Cloud CredentialsT1114.002 Remote Email CollectionT1530 Data from Cloud Storage
- Vendors
- Microsoft
- Threat actors
- Storm-3121Storm-3032ShinyHuntersFalconHelixBlackFile
From the original article
3 min read at helpnetsecurity.com
Attackers are calling or texting employees on their personal phones, posing as internal IT staff, in a social engineering campaign that tricks them into handing over access to corporate cloud accounts. Once inside, they pull files and email from Microsoft 365 apps, SharePoint, OneDrive, and inboxes, for weeks at a time, according to Microsoft Security Research.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.