Microsoft Defender for Endpoint

Microsoft traces four months of Graph-based mail theft to fake passkey helpdesk calls

Since May, intruders posing as IT have walked employees through a passkey update on their personal phones, then registered their own authentication method and pulled mail and files through Graph, SharePoint and Exchange APIs.