Attackers are calling or texting employees on their personal phones, posing as internal IT staff, in a social engineering campaign that tricks them into handing over access to corporate cloud accounts. Once inside, they pull files and email from Microsoft 365 apps, SharePoint, OneDrive, and inboxes, for weeks at a time, according to Microsoft Security Research.
(Source: Microsoft)
Researchers have been tracking the campaign since May 2026. Because the initial contact often happens on a personal phone that isn’t managed by the company, it can leave little behind for investigators to find. In several reviewed cases, the only lead was an employee remembering the call or text.
“The caller creates a sense of urgency, explaining that a passkey, multifactor authentication (MFA), or single sign-on (SSO) configuration must be updated immediately to avoid disruption,” the researchers wrote. Employees are sent a link that opens a page built to look like a Microsoft sign-in screen.
“Despite the frequent use of passkey-themed lures, passkey enrollment is often not the actor’s true objective. Instead, the passkey narrative serves as a convincing pretext to guide victims through adversary-in-the-middle (AiTM) phishing or device-code authentication flows,” Microsoft noted.
Before making contact, the attackers appear to do their homework, gathering details about staff and organizational structure from public sources, including professional networking sites. In some cases, they reuse an already compromised employee account to send the same passkey pitch to coworkers over Microsoft Teams, a tactic that increases the likelihood of engagement.
“A commonly observed technique involves registering generic domains and embedding the target organization’s name as a subdomain, creating URLs that appear familiar at first glance. Multiple domains may be created for the same organization, allowing the actor to rotate infrastructure as needed,” they explained.
Compromised accounts become a persistent foothold
Once an attacker is inside an account, the priority shifts to staying there. They register a phone number, authenticator app, or software-based one-time password token of their own under the compromised identity, so any future login challenge can be approved without the actual user involved.
Microsoft calls this a “durable persistence mechanism,” one that survives even after the initial stolen token or session expires, as long as the attacker-registered MFA method stays in place.
Microsoft Graph activity can be difficult to detect
With a foothold secured, the attackers turn to Microsoft Graph, the API that ties together users, files, mail, and permissions across a Microsoft 365 tenant. They use it to enumerate accounts, groups, admin roles, registered authentication methods, and connected applications.
Microsoft flags this stage as the hardest to catch. A single request to an endpoint like /users or /sites looks like ordinary enterprise traffic. The signal only shows up once the same identity or access token works through several categories of Graph queries in sequence, moving from user and group data toward mail and file content.
“This attack serves as a strong example of why Graph activity must be assessed holistically, with emphasis on behavioral progression and cross-event correlation rather than individual API requests in isolation.”
Data theft stays below usage thresholds
The last stage is collection, and Microsoft observed high volumes of file access and downloads from SharePoint Online and OneDrive for Business, with some intrusions extending into email pulled from Exchange Online through REST APIs.
Researchers describe the pace as “measured and sustained,” stretching over hours in some intrusions and multiple days in others, with attackers capping their activity below 1,000 files or emails per hour. That threshold keeps the traffic blending into normal account use while letting them extract large volumes of data without tripping usage alarms.
The traffic often carries the python-httpx user agent, a marker tied to automated, high-volume access rather than someone clicking through folders one at a time, though Microsoft cautions against reading too much into that detail on its own.
“The user agent alone should not be treated as malicious,” the researchers noted. “Instead, such activity should be evaluated in the broader context of data volume, affected identities, source infrastructure, prior reconnaissance activity, and evidence of identity compromise.”
Microsoft Threat Intelligence attributes the initial access activity to a range of threat actors, including Storm-3121 and Storm-3032, among others. Storm-3121 feeds into ShinyHunters and Falcon extortion operations. Storm-3032 grew out of the BlackFile group and now runs its own extortion operation under the Helix name.
To help against it, Microsoft recommends the usual defensive measures, such as phishing-resistant MFA through Conditional Access, admin approval for new app consent, and managed-device requirements before anyone can sign in to Exchange, SharePoint, or privileged Graph applications.