Loading story…
Microsoft Security Research reported cloud-account intrusions active since May 2026 in which attackers impersonate IT helpdesks through phone calls, SMS, and occasionally Microsoft Teams. The campaigns use passkey-, MFA-, and SSO-themed lures to direct users to adversary-in-the-middle phishing pages or device-code authentication flows, capturing credentials, session tokens, or attacker-authorized tokens for Microsoft cloud identities.
After gaining access, the actors register attacker-controlled MFA methods, enumerate tenant resources through Microsoft Graph, and steal data from SharePoint, OneDrive, Exchange mailboxes, and attachments. Microsoft linked the initial-access ecosystem to Storm-3121, associated with ShinyHunters and Falcon extortion activity, and Storm-3032, a BlackFile splinter operating under the Helix banner; defenders should investigate identity and cloud telemetry, revoke sessions and refresh tokens, remove unauthorized authentication methods, and require phishing-resistant MFA with restrictive Conditional Access policies.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Researchers identified 17 FQDNs created beginning August 28, 2026, potentially linked to Com-affiliated actors including Bling Libra and CL-CRI-1116. The domains impersonate Mailchimp or SendGrid and use passkey, MFA, and SSO themes; associated subdomains suggested possible vishing targeting multiple business sectors.
Microsoft Security Research observed active intrusions targeting Microsoft cloud accounts beginning in May 2026. The activity used passkey-, MFA-, and SSO-themed helpdesk impersonation to obtain credentials, session tokens, or device-code-authorized tokens, then registered attacker-controlled MFA methods and collected cloud and email data; Microsoft linked the initial-access ecosystem to Storm-3121 and Storm-3032 among other actors.
Microsoft associated Storm-3121 with ShinyHunters and Falcon extortion activity and assessed that Storm-3032 includes BlackFile members operating under the Helix name. Microsoft also noted overlap with Google's UNC6671 activity, which Google linked to BlackFile, Helix, Falcon, Pink, and Redact extortion gangs.
Reporting detailed the campaign's use of compromised Teams accounts, attacker-controlled MFA enrollment, Microsoft Graph reconnaissance, and throttled collection from SharePoint, OneDrive, and Exchange Online. It also identified persistence telemetry, the python-httpx user agent, anonymous proxy use, and phishing domains including passkeyhelpdesk.com, secure-passkey.com, and integratedsso.com.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 35 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
15 references tracked. Mallory keeps watching after this page renders.
blog.knowbe4.com
Open sourcebleepingcomputer.com
Open sourcecysecurity.news
Open sourcecommunity.gurucul.com
Open sourcemicrosoft.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A widespread phishing campaign is compromising **Microsoft 365** accounts with adversary-in-the-middle login pages that capture session material even when MFA is enabled, then using those identities to target payroll, HR, finance, and administrative staff across healthcare, education, manufacturing, government, and professional services in the United States, Canada, and Europe. Arctic Wolf said the activity aligns technically and behaviorally with Microsoft-tracked **Storm-2755** (also known as **Payroll Pirates**), with attackers maintaining access through rotating residential proxies and automated session activity roughly every eight hours while quietly collecting mailbox data tied to financial workflows. Reporting also shows the intrusions can progress without additional device compromise, shifting instead into **identity-plane lateral movement** inside **Entra ID** and Microsoft 365. After an initial phish, attackers can use stolen session tokens to enumerate the tenant through **Microsoft Graph**, register a malicious Entra ID application, create a service principal, grant permissions such as `Mail.Read` and `Mail.Send`, and access other users’ mailboxes, including executives, before sending fraudulent messages through Graph API that pass SPF and DKIM checks. Defenders were urged to correlate cloud identity, Graph, sign-in, and email telemetry for signals including **OfficeHome error 90014**, anomalous Outlook sign-ins with **Firefox** user agents, repeated `SessionID` reuse across changing IPs and geographies, suspicious app registrations, credential additions to service principals, and unusual application access to user mailboxes.
Aug 10, 2026
Microsoft disclosed a large-scale phishing campaign that targeted more than **35,000 users** at over **13,000 organizations** across **26 countries**, with most victims in the United States and concentrations in healthcare, life sciences, financial services, professional services, and technology. The operation used code-of-conduct and compliance-themed emails delivered through legitimate email services, including abuse of platforms such as Amazon SES, to make messages appear trustworthy and help them pass common email authentication checks. Victims received PDF attachments containing links that led through fake CAPTCHA and document-review pages before landing on spoofed Microsoft sign-in portals. Microsoft said the attackers used an **adversary-in-the-middle** phishing flow to capture credentials and authentication tokens in real time, allowing them to bypass weak multifactor authentication and gain immediate account access. The company described the activity as one of the most sophisticated code-of-conduct-themed credential theft campaigns it has observed and said it reflects broader trends including CAPTCHA-gated phishing, QR-code phishing, and phishing-as-a-service ecosystems such as **Tycoon 2FA**, **Kratos**, and **EvilTokens**. Microsoft urged organizations to strengthen defenses with Defender for Office 365, SmartScreen-enabled browsers, phishing awareness training, stronger authentication, conditional access policies, and automated attack disruption in Defender XDR.
Jun 29, 2026
Attackers abused Microsoft’s legitimate authentication and Microsoft 365 infrastructure to run phishing and business email compromise campaigns without relying on fake login pages. Check Point observed more than 200 phishing emails sent to about 120 organizations across industries and countries, using Microsoft Planner-style notifications about HR, payroll, and benefits updates as lures. Victims were directed to a real `login.microsoftonline.com` authorization page and asked to approve a malicious OAuth application, after which Microsoft redirected the browser to an attacker-controlled AWS API Gateway endpoint that captured an authorization token for exchange into Microsoft account access. Researchers said the technique could give attackers broad access to Microsoft 365 data depending on granted permissions, including email, files, Teams chats, SharePoint, OneDrive, and calendar content, creating risks of credential theft, account takeover, data breaches, financial fraud, malware delivery, and BEC. High-value and privileged users, organizations handling sensitive data, tenants using Microsoft ADFS, and general Microsoft 365 users were identified as potential targets. Recommended defenses include enforcing MFA, auditing Microsoft 365 tenant and OAuth application settings, strengthening email and application security controls, applying sign-in risk policies, and training users to scrutinize consent prompts as well as phishing lures.
Aug 11, 2026