Microsoft is warning customers of two recent social engineering campaigns aimed at compromising Microsoft accounts to target cloud-based assets and directing fraudulent business transactions over email.
The first campaign, detailed in
a Sept. 9 blog post, involves calls or messages to victims’ personal phone numbers claiming they need to update a passkey, multi-factor authentication (MFA) or single sign-on (SSO) configuration. The attacker leads the victim to a fake log-in page and steals their credentials and session token using adversary-in-the-middle (AiTM) techniques, or alternatively gains access via device code phishing.
The second campaign targets employees over email and involves impersonation of executive team members such as the company CEO or president, urging the employee to process an Automated Clearing House (ACH) payment totaling nearly $50,000. This scam is suspected to involve the use of generative AI to create convincing fake email threads, Microsoft said in
a Sept. 10 blog post.
Both attacks can lead to significant financial loss, as Microsoft noted that the theft of cloud-stored assets through compromised accounts is commonly followed by extortion from groups such as
ShinyHunters and
Helix.
SharePoint, OneDrive, Exchange data harvested through stolen identities
The identity-based attacks stemming from phishing or vishing attacks on victims’ personal phones, observed since May 2026, follow two main attack paths: AiTM and device code phishing.
In AiTM attacks, users complete a log-in on a convincing fake Microsoft portal on the attacker’s domain, enabling the attacker to capture credentials and session tokens to defeat MFA.
The attacker uses generic passkey and identity-themed domain names such as passkeyhelpdesk[.]com or integratedsso[.]com combined with a subdomain named after the targeted company to make the lure appear more convincing (ex. victimcompany[.]secure-passkey[.]com).
Another version of the attack abuses the legitimate Microsoft device code approval flow to grant access to an attacker-controlled device; the user logs in normally and is convinced to enter a device code into the Microsoft authentication page. These device codes are typically used to access Microsoft accounts from IoT devices such as gaming systems and smart TVs, but can be abused through phishing attacks to compromise accounts and effectively bypass MFA.
Once the attacker gains access to the victim’s account, they register a new MFA device to ensure persistent access. Then, they use Microsoft Graph to perform reconnaissance of users, groups, permissions and accessible resources and content from within the account, inventorying targets for further identity compromise and data exfiltration.
Microsoft observed attackers perform high-volume data collection from SharePoint Online and OneDrive for Business cloud storage, as well as Exchange Online email content via the REST API. The data collection followed a pattern consistent with an automated process, with the python-httpx user-agent seen associated with the high-volume cloud storage retrieval.
The attackers paced the data theft to access fewer than 1,000 files each hour, helping the collection activity blend in with normal business activity across the organization, Microsoft noted.
“The actor registers their own authenticator method, maps the tenant through Microsoft Graph, and pulls files and mail at a pace that reads like a busy employee. None of those calls is suspicious on its own. The sequence is,” noted Jon Baker, vice president of threat-informed defense at AttackIQ, in an email to SC Media. “That sequence is what defenders should be testing. Emulate a new MFA method added right after an unusual sign-in, programmatic Graph enumeration, and a scripted client draining OneDrive. See what fires.”
Microsoft stated that the initial access methods are consistent with those used by a range of threat groups including Storm-3121 and Storm-3032. Storm-3121 initial access activity has been seen associated with follow-on extortion by the ShinyHunters and Falcon groups, while Storm-3032 is associated with the Helix extortion group.
To protect against these attacks, Microsoft recommended enforcing the use of phishing-resistant MFA methods such as FIDO2 passkeys or Windows Hello for Business, using Condition Access to only allow Exchange, SharePoint and Graph-privileged app access from managed devices, enforcing risk-based access policies, training employees to recognize MFA phishing including vishing attacks and blocking the device code flow when it is not necessary for normal business.
The company also recommended investigating any high-volume or programmatic Microsoft Graph activity and correlating this activity with identity and authentication events when investigating an incident. In the event of a compromise, the organization should revoke active sessions, refresh tokens, reset credentials and remove any attacker-registered authentication methods or attacker-created mailbox rules.
CEO, ServiceNow impersonation leveraged in email fraud attacks
In a separate campaign, Microsoft observed attackers impersonating company executives to convince employees to process fraudulent transactions of nearly $50,000 under the guise of paying an invoice from ServiceNow or another legitimate vendor. The company noted that neither the executives’ accounts nor the vendors themselves were compromised in this attack; instead, the attackers crafted convincing fake email threads and invoices, likely with the assistance of generative AI.
Between Aug. 3 and 5, Microsoft saw more than a million emails sent in this campaign, with 87.7% of targets residing the United States. The victims received what appeared to be a forwarded email chain between an executive, such as the CEO, president or CFO, and a vendor, such as ServiceNow, discussing and approving a fake invoice. At the top of the chain, the executive asks the employee to complete the payment.
Microsoft noted signs of AI generation in this crafted email chains, including the presence of extensive HTML comments and heavy use of em dashes. In these emails, the sender display name, reply-to display name and email signature were made to match the impersonated executive and a detailed fabricated invoice was attached including itemized line items and vendor branding.
“Social engineering used to depend heavily on whether an attacker could convincingly play a role. As time has gone on, AI has changed the economics of that effort. Attackers can spend far less time building the details that give a fraudulent request credibility. They can also adapt those details for far more targets,” Nick Tausek, lead security automation architect at Swimlane, said in an email to SC Media.
Some suspicious inconsistencies were found in the emails, such as formatting differences between real email threads and the crafted ones, and a lack of data headers in the threads that would normally be seen in forwarded emails. Additionally, in one example, the “CEO” appeared to request that ServiceNow send the invoice directly to the employee without copying them, but the email then appeared to be forwarded from the CEO themselves.
The attacker used several third-party email service accounts to send out the more than one million emails, and was noted to have registered several lookalike domains, including “service-nowinc[.]com” prior to the campaign. Microsoft also observed that the emails appeared to be generated based on a template, as the narrative structure and invoice identifiers remained consistent across samples but with different organization-based details switched in.
Microsoft recommended its customers enable zero-hour auto purge (ZAP) in Office 365, which leverages real-time threat intelligence to quarantine emails and retroactively “neutralize” suspicious emails that have already landed in inboxes. The company also recommended configuring automatic attack disruption in Microsoft Defender XDR to limit the impact of similar business email attacks.
