Security1 publisher2 min readPublished
Fake IT callers register their own MFA method under the Microsoft 365 identities they phish
Microsoft has tracked this since May 2026. First contact lands on an unmanaged personal phone, and the attacker's own authenticator outlives the stolen session, so tenant telemetry only starts after the account is already lost.
The Watch · Security desk
What happened
- Microsoft Security Research has tracked a campaign since May 2026 in which attackers call or text employees on their personal phones, posing as internal IT, to take over corporate Microsoft 365 accounts.
- The caller says a passkey, MFA or SSO setting must be updated at once, but Microsoft says the passkey story is a pretext for adversary-in-the-middle phishing or device-code authentication flows.
- Inside the account, the attacker registers a phone number, authenticator app or software OTP token of its own, so later login challenges are approved without the real user being involved.
- Collection means high-volume file downloads from SharePoint Online and OneDrive for Business, with some intrusions reaching into Exchange Online mailboxes through REST APIs.
- In some cases the operators send the same passkey pitch to coworkers over Microsoft Teams from an employee account they have already compromised.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint An investigation that begins in the tenant begins after the loss; the earliest artifact is a help desk record of an unsolicited IT call, which most organizations do not keep in a searchable form.
- capability Rate-limited theft makes volume-threshold DLP the wrong tripwire, because the operator never produces the spike those rules are tuned to fire on.
- decision Self-service MFA enrollment functions as a persistence control, not just a convenience feature, and gating it behind out-of-band verification is the cheapest single control in this chain.
- exposure The reachable surface is an employee's personal number plus a public org chart assembled from professional networking profiles, and the company controls neither.
Microsoft's own detection guidance says where the coverage stops. A single request to a Graph endpoint like /users or /sites looks like ordinary enterprise traffic, and the company flags this stage as the hardest to catch [8]. The signal only appears when one identity or access token works through several categories of Graph queries in sequence, moving from user and group data toward mail and file content [9]. Catching that means retaining Graph audit data long enough to see the progression, which is a retention and licensing decision made before the intrusion rather than during it.
The collection rate is set to defeat the other half of most stacks. Microsoft observed activity deliberately held below 1,000 files or emails per hour, sustained over hours in some intrusions and multiple days in others, specifically to stay under usage alarms [10]. At that ceiling an operator moves just under 24,000 items in a 24-hour day [19]. Microsoft reports access persisting for weeks [2]. At that pace, an operator can pull far more out of an account over those weeks than any single document store would normally hold.
The identity-side control point is narrow and specific. It is the registration of a new phone number, authenticator app, or software OTP token under an account that already has one [6]. Microsoft calls that a durable persistence mechanism because it survives expiry of the stolen token or session [7]. Unverified self-service MFA enrollment is the attacker's foothold.
Two details in the report resist clean rules. The collection traffic often carries the python-httpx user agent, a marker of automated high-volume access [11], and Microsoft says plainly that the user agent alone should not be treated as malicious [12]. The phishing sites are generic domains with the target organization's name embedded as a subdomain, several per organization, rotated as needed [5], so a blocklist ages out fast.
What the material does not carry: no named actor, no victim count, no geography, no CVE [20], and none of it is patchable. In several reviewed cases the only lead investigators had was an employee remembering the call or text [4], because the first contact happened on a phone the company does not manage [3]. That puts the earliest usable record in the help desk's hands, not the SOC's.
What to watch
- Whether Microsoft attributes this campaign to a named actor or tracked group, which would tie it to earlier device-code phishing waves.
- A Microsoft change that requires re-verification for MFA method registration in Entra ID by default rather than by tuned policy.
- Any sign the same operators move past Graph reads into mailbox rules or application consent grants.