30
30
Attackers call employees’ personal phones to break into Microsoft 365 accounts
Microsoft tracks vishing campaigns by Storm-3121 and Storm-3032 that impersonate IT staff, phish Microsoft 365 credentials, and steal cloud data.
Microsoft Security Research has tracked a campaign since May 2026 in which attackers call or text employees' personal phones posing as IT staff, using passkey/MFA/SSO lures to run adversary-in-the-middle phishing or device-code authentication flows. Attackers register their own MFA methods for durable persistence, abuse Microsoft Graph for tenant discovery, and download SharePoint, OneDrive, and Exchange data below 1,000 files or emails per hour to avoid detection. Microsoft attributes initial access to actors including Storm-3121, which feeds ShinyHunters and Falcon extortion operations, and Storm-3032, the Helix extortion operation descended from BlackFile.
74
30
30
42
30
30
55
30
30
30
30
60
30
55
30
30
30
30
30
BigBear 2.0 Evilginx2 Phishing Campaign Bypasses Microsoft 365 MFA With Session Cookie Theft
CloudSEK identified BigBear 2.0, an Evilginx2-based AiTM phishing operation stealing Microsoft 365 MFA session cookies, hitting 461 organizations across 40-plus countries.
The campaign proxies Microsoft sign-in pages to capture credentials and authenticated session cookies, enabling session replay into email, Teams, SharePoint, OneDrive, and connected SSO applications. CloudSEK's June 2026 discovery found 5,137 stolen records, 1,032 passwords, and 4,148 session cookies tied to 3,331 victim IPs, linked to operator 'General Boss' across 42 VPS nodes. The operation targeted IT services and managed service providers, used country-matched residential proxies, and involved at least five affiliates.
74
IT Help Desk Impersonation Lets Hackers Bypass MFA
Arctic Wolf tracks PREY-0058 posing as IT help desk to steal Microsoft 365 sessions via AiTM panels, then extorting executives after SaaS data theft.
Arctic Wolf documented a threat cluster tracked as PREY-0058 that impersonates internal IT help desk staff by phone, luring Directors, VPs, and executives to authentication-themed URLs formatted as victim-organization lure domains. Adversary-in-the-middle panels intercept credentials and MFA approvals, and stolen sessions are replayed through residential proxies such as NodeMaven from IPs matching the victim's geo-location and ASN, defeating impossible-travel alerts. Attackers perform discovery against SharePoint and Entra ID, then harvest data from OneDrive, Exchange, and Box before issuing extortion demands. Defenders are advised to require managed devices, use phishing-resistant MFA like FIDO2, enable Continuous Access Evaluation, and monitor sign-ins, SharePoint SearchQueryPerformed, and MailItemsAccessed events.
72
30
ThreatsDay Bulletin: Claude Security Plugin, Azure Priv-Esc, Kali365 MFA Bypass, FIFA Scams +15 More
60
30
55
55
42
30
30
30
30
55
30
GhostCode Phishing Kit Bypasses Microsoft 365 MFA to Hijack Accounts in 78 Seconds
eSentire identified GhostCode, a phishing kit abusing Microsoft 365 OAuth device-code sign-in to steal tokens and take over accounts in seconds.
eSentire analysts identified GhostCode in late August, a phishing kit that uses business contact-form messages and an NDA pretext to deliver a password-protected HTML attachment leading victims to a Microsoft device-code sign-in. Victims authenticate on legitimate Microsoft pages, letting the kit obtain a Primary Refresh Token in 32 seconds and register three devices in 78 seconds, with residential proxies matching the victim's location. The kit hides its redirect with encrypted addresses, junk data, and scanner-filtering challenges, and uses GHOSTnet-linked infrastructure during device enrolment. eSentire recommends blocking device-code authentication via Conditional Access, invalidating tokens, and reviewing newly enrolled devices.
72
Hackers Use Blob URLs and Microsoft Teams to Create Phishing Pages Inside Victims’ Browsers
Barracuda details a phishing campaign using Microsoft Teams OAuth redirects and browser blob URLs to render local fake DocuSign login pages for credential theft.
Barracuda researchers identified an active phishing campaign that routes DocuSign-themed emails with calendar invites through a Microsoft OAuth endpoint and crafted redirects into Microsoft Teams, then renders a fake sign-in page via a browser-generated blob URL. Because the page is assembled locally in memory and can register service workers and run in a sandboxed iframe, URL-reputation checks largely see legitimate Microsoft domains. The goal is credential theft and account takeover, not a flaw in Teams itself.
48
New Phishing Attack Uses Blob URLs to Hide Malicious Pages From Security Scanners
Barracuda detailed a DocuSign-themed phishing campaign that renders credential-harvesting pages as browser blob URLs, evading URL reputation and blocklist defenses.
Barracuda researchers report a credential-harvesting phishing campaign that starts with a DocuSign-themed email containing a calendar invitation and routes victims through legitimate Microsoft OAuth endpoints and Microsoft Teams. A crafted redirect parameter leads Teams to load external content from cdn.bloom[.]io, which the browser renders as a blob URL — a session-only address held in local memory with no persistent public URL to crawl, categorize, or blocklist. The locally generated page registers a service worker, runs inside a sandboxed iframe, and is dynamically steered by backend infrastructure, indicating a centrally managed phishing platform. Barracuda recommends phishing-resistant MFA such as FIDO2 keys and passkeys, monitoring OAuth flows and redirect chains, and Teams malicious URL protection.
48
Cybercriminals are building phishing pages that exist only inside victims’ browsers
Barracuda details a DocuSign-themed phishing campaign that renders login pages locally via blob URLs, abusing genuine Microsoft OAuth and Teams infrastructure.
Barracuda researchers describe a phishing campaign that starts with DocuSign-themed emails carrying calendar invites pointing to genuine Microsoft OAuth endpoints, then routes victims through Microsoft Teams to a resource hosted on cdn.bloom[.]io. The login page is assembled entirely inside the victim's browser from a blob URL, registers a service worker, and runs inside a sandboxed iframe that receives live instructions from the attacker's backend. Hidden command-and-control configuration indicates the page is part of a centrally managed phishing platform that can be updated and steered across many victims. Barracuda recommends phishing-resistant MFA such as FIDO2 keys or passkeys, monitoring of OAuth flows and redirect chains, and behavior-based identity controls rather than URL blocklisting.
55
MFA's Weakest Link: Account Recovery Is the New Attack Path
Help desk account recovery is increasingly the weakest link in MFA-protected identities, as Scattered Spider's impersonation-driven Marks & Spencer attack demonstrated.
As MFA, conditional access, and phishing-resistant factors raise the cost of direct account takeover, attackers increasingly target the recovery process, convincing service desk staff to reset passwords or re-register MFA on attacker-controlled devices. CISA, FBI, and partner advisories describe Scattered Spider posing as employees to trigger such resets; the 2025 Marks & Spencer attack began this way and led to ransomware with an estimated £300 million profit impact. Microsoft now describes Entra ID account recovery as a high-assurance process, and the article promotes Specops Secure Service Desk for verified identity workflows.
32