Loading story…
Microsoft said DEV-0537, also tracked as LAPSUS$ and later Strawberry Tempest, ran a broad campaign of identity-driven intrusions that led to data theft, extortion, and destructive actions against organizations in government, technology, telecom, media, retail, healthcare, manufacturing, energy, and higher education. The group reportedly gained access through stolen credentials, session token replay, MFA fatigue, SIM swapping, help-desk social engineering, and recruiting insiders or suppliers, then moved to reconnaissance, privilege escalation, data exfiltration, and deletion of cloud and on-premises resources. Microsoft also disclosed that the actor accessed a single Microsoft account with limited permissions and viewed some source code, but said no customer code or customer data was affected.
The reporting and Microsoft guidance underscore that push-based MFA abuse was a key part of the actor’s playbook, prompting stronger controls around authentication workflows. Microsoft’s Entra documentation says number matching is now enabled for Authenticator push notifications to replace weaker approve/deny prompts, extending across Entra MFA, self-service password reset, combined registration, and supported AD FS deployments, while older or unsupported environments may still require updates or alternate methods such as TOTP. The company recommended hardening identity protections, restricting access to trusted devices, improving cloud security posture, and preparing incident-response teams for adversaries that may monitor or interfere with response communications.
Get the infrastructure and lures behind it.
6 events from the most recent confirmed update back to the earliest known activity.
In the same disclosure, Microsoft said DEV-0537 compromised a single Microsoft account with limited access and viewed some source code. Microsoft stated no customer code or customer data was involved.
Microsoft disclosed a large-scale social engineering, data theft, destructive attack, and extortion campaign by DEV-0537, also known as LAPSUS$. The company said the actor targeted organizations globally after initially focusing on the United Kingdom and South America.
Microsoft says Windows Server 2019 supports AD FS adapter number matching after update KB5007206 and Windows Server 2022 after KB5007205. Both updates are cited as prerequisites for number matching support.
Microsoft says Windows Server 2016 supports AD FS adapter number matching after update KB5006669 (OS Build 14393.4704). This update is identified as enabling number matching support on that platform.
Unit 42 says the first attack activity using the Lapsus$ handle was observed in August 2021, when some U.K. mobile phone customers reported threatening text messages. The report presents this as the earliest observed activity tied to the group’s public handle.
Microsoft states that number matching is now enabled for all Authenticator push notifications as a security improvement over Approve/Deny prompts. The guidance says the feature applies across Microsoft Entra MFA and related workflows.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
docs.microsoft.com
Open sourcemichaelkoczwara.medium.com
Open sourceunit42.paloaltonetworks.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft confirmed that **LAPSUS$** compromised a single employee account and used that foothold to gain limited access to internal source-code repositories, leading to the leak of code tied to projects including **Bing**, **Cortana**, and **Bing Maps**. The company said no customer code or customer data was affected and that the compromised account was remediated, but the incident reinforced the group’s ability to turn relatively simple access methods into high-impact breaches at globally recognized targets. Reporting across multiple investigations describes LAPSUS$ as a fast-moving **data extortion** actor that relied heavily on **social engineering**, **SIM swapping**, **credential theft**, **session-token abuse**, **MFA fatigue**, help-desk manipulation, and purchases or solicitation of insider access rather than advanced malware or ransomware deployment. The group publicly used **Telegram** to leak stolen data, pressure victims, and recruit access brokers, and it was linked to intrusions affecting organizations including **NVIDIA, Okta, Samsung, Microsoft, Vodafone Portugal, Ubisoft, LG**, and Brazil’s **Ministry of Health**; researchers said its behavior mixed financial motives with disruption, publicity, and notoriety, suggesting the threat could persist through remaining members or copycat actors even after arrests.
Aug 15, 2026
Threat researchers reported multiple **MFA-bypass** techniques being operationalized against enterprise users, with a notable focus on Microsoft 365 and common authentication workflows. KnowBe4 Threat Labs described an active phishing campaign targeting North American organizations that abuses the **OAuth 2.0 Device Authorization Grant** (`microsoft.com/devicelogin`) to trick users into entering an attacker-supplied device code on a legitimate Microsoft page; after the user completes MFA, the attacker obtains valid **OAuth access/refresh tokens**, enabling persistent access to M365 services (e.g., Outlook, Teams, OneDrive/SharePoint) without stealing passwords. Recommended mitigations included auditing newly consented OAuth apps, hunting for related email lure patterns, and considering disabling the device code flow via Conditional Access. Separately, Okta warned of emerging **voice-phishing (vishing) kits** that provide real-time, client-side “session orchestration,” allowing attackers to dynamically change phishing pages while on a phone call to coax victims into approving push prompts or providing OTPs; captured credentials are commonly exfiltrated to attacker-controlled channels (e.g., Telegram) and then replayed against legitimate sign-in flows. Cyble also documented the continued evolution of **SMS/OTP (and voice) bombing** ecosystems, highlighting automated, API-driven abuse of authentication endpoints across multiple sectors and regions, with tooling maturing into cross-platform applications and adding evasion features—activity that can facilitate social engineering and account takeover by overwhelming users with authentication messages or calls.
Jun 29, 2026
Active phishing campaigns are using the **Jalisco** and **OmegaLord** kits to compromise Microsoft 365 accounts with techniques designed to bypass or weaken multi-factor authentication. According to ReliaQuest, Jalisco abuses the OAuth 2.0 device authorization flow by generating fresh Microsoft device codes in real time and tricking victims into authorizing attacker-controlled devices, allowing attackers to obtain OAuth tokens without directly stealing passwords. OmegaLord uses a fake PDF reader login page to harvest credentials and victims’ phone numbers, which may help attackers intercept or manipulate MFA challenges. After gaining access, attackers have been observed moving quickly through SharePoint and other SaaS platforms to locate and exfiltrate sensitive data, sometimes within minutes, and may follow with extortion threats. ReliaQuest also reported that threat actors register multiple devices to compromised Microsoft Entra ID accounts to preserve access and refresh tokens even after password resets, reflecting a broader surge in phishing-as-a-service activity tied to platforms including **EvilTokens**, **Kali365**, **Tycoon2FA**, **Venom**, and **Darcula**. Defenders are being urged to reduce Entra ID device-registration limits, disable or restrict device code authentication through Conditional Access or Okta where not needed, and audit unnecessary app registrations.
Jul 23, 2026