Microsoft Security Research is tracking active cloud-based intrusions spanning multiple accounts in which unusual sign-ins were followed by threat actor-added authentication methods, high-volume Microsoft Graph activity, SharePoint and OneDrive downloads, and email collection through REST APIs. Microsoft Security Research assesses that this sequence is consistent with automated collection from compromised cloud identities using proxy-associated infrastructure, the activity has been observed since May 2026.
The activity begins with identity-focused social engineering and impersonation infrastructure, proceeds through authentication persistence and cloud reconnaissance, and is followed by targeted data access and activity consistent with data collection and potential exfiltration. Domains, IP addresses, and hosting providers can change quickly, but the recurring sequence of identity compromise, persistence, reconnaissance, content discovery, and exfiltration provides a more durable basis for investigation. Defenders should investigate this sequence across identity, Microsoft Graph, SharePoint, OneDrive, and Exchange signals, then revoke sessions and remove unauthorized authentication methods for confirmed compromises.
Attack chain overview
Step 1-2 : Initial access: Passkey and SSO lures
The attack often begins with a seemingly routine call or message on a user’s personal phone number from someone claiming to be from the organization’s IT helpdesk. The caller creates a sense of urgency, explaining that a passkey, multifactor authentication (MFA), or single sign-on (SSO) configuration must be updated immediately to avoid disruption. Employees are directed to a website that closely resembles a legitimate Microsoft sign-in experience and may receive the link through SMS messages sent directly to their personal mobile phones.
Despite the frequent use of passkey-themed lures, passkey enrollment is often not the actor’s true objective. Instead, the passkey narrative serves as a convincing pretext to guide victims through adversary-in-the-middle (AiTM) phishing or device-code authentication flows. In AiTM scenarios, the actor captures credentials and session tokens; in device code attacks, the victim unknowingly authorizes access on the actor’s behalf. This initial interaction may leave very little forensic evidence. If the victim opens the phishing link on a personal mobile device that is not onboarded to Microsoft Defender for Endpoint, the related activity may be absent from endpoint telemetry.
In many investigations, the employee’s recollection of a phone call or text message becomes the earliest and sometimes the only evidence explaining how the compromise began. As a result, investigators must often reconstruct the attack by connecting these reports with subsequent sign-ins, device code authentication events, token activity, and authentication method changes.
Reconnaissance on targeted organization
The actor appears to invest heavily in pre-attack research, likely gathering information about employees and organizational structure from public sources such as social networking and professional profiling platforms.
Reusable domains, personalized targeting
In a smaller number of cases, actors take advantage of already compromised accounts to expand their reach. Using a trusted employee identity, they send similar passkey-themed messages through Microsoft Teams, making the request appear legitimate and significantly increasing the likelihood of engagement. To support these operations, the actors rapidly deploy convincing phishing infrastructure built around themes such as passkeys, SSO enrollment, account activation, and identity verification.
A commonly observed technique involves registering generic domains and embedding the target organization’s name as a subdomain, creating URLs that appear familiar at first glance. Multiple domains may be created for the same organization, allowing the actor to rotate infrastructure as needed. These domains are often registered with Nicenic registrar (observed in previous extortion campaigns) and operational within hours, giving defenders little opportunity to identify and block the infrastructure before employees encounter it. Registration alone should not be interpreted as evidence of registrar involvement in the activity. For example, company-name.integratedsso[.]com and company-name.secure-passkey[.]com illustrate how the same company name can appear under different actor-controlled domains.
Together, the phone-based social engineering, personalized targeting, trusted internal messaging, and rapidly changing phishing infrastructure form the opening chapter of a highly coordinated intrusion designed to blend technical deception with human trust.
The actor creates domains following the pattern companyname[.]maliciousdomain[.]com to impersonate organization-specific authentication portals. Including the victim organization’s name in the URL helps establish credibility and can persuade users to proceed with authentication. Example: contoso[.]add-passkey[.]com.
| Theme | Domain examples, defanged |
| Passkey | passkeyhelpdesk[.]com, secure-passkey[.]com†, setupmypasskey[.]com†, add-passkey[.]com† |
| SSO and identity provider | integratedsso[.]com†, oktasession[.]com |
| Key setup and synchronization | keysyncos[.]com, oskeysync[.]com, oskeysetup[.]com, oskeyregister[.]com, syncmykey[.]com, myconnectkey[.]com, oskeyconnect[.]com |
| Setup and verification | validationsetupac[.]com, portalsetuphub[.]com |
Step 3-4 : User identity compromise
From one sign-in to broader application access
In one investigated attack sequence, the activity began with an anomalous sign-in to Microsoft OfficeHome application from an unmanaged device, possibly attacker-owned. Once MFA was completed, the actor began accessing identity portals such as My Sign-Ins and enterprise application stores such as My Apps. Sign-in artifacts, including user-agent patterns, indicated possible AiTM phishing.
Using the same session, the actor further accessed several management applications, including Microsoft Approval Management, which is used for identity and approval-related services. SharePoint Online and OneDrive were used to enumerate sensitive files, primarily through the Graph API. The investigation revealed that the actor’s sessions persisted for approximately one hour while enumerating sensitive files and internal applications.
Passkey lure leads to device code phishing
In another investigated attack sequence, the actor was observed using the device code flow to compromise the session token after the passkey lure. In device code phishing, the user is persuaded to enter a code on the legitimate Microsoft authentication page. This approval issues a token to an attacker-controlled client, which can then access permitted resources without stealing a browser cookie. Following the device code flow, the actor successfully replayed the compromised token, effectively bypassing MFA and conducting enumeration and further attack progression.
Reusing the same credentials after an earlier compromise
The third attack pattern involved the actor signing in with compromised credentials, with MFA approved using a previously registered PhoneAppOTP method. This suggests that the attacker had registered the authenticator app days before launching the campaign. Once the sign in was successful, the actor followed the same reconnaissance pattern observed in other attack sequences. This activity was primarily carried out using an automated system developed with Node.js and Microsoft Graph.
To illustrate how the activity unfolded over time, the following timeline summarizes the key events identified during the investigation.
| Time, UTC | Application or resource | What happened and why it matters |
| T+0min | OfficeHome | Sign-in from an unmanaged context received error 50074, requiring secondary authentication / Multifactor authentication (MFA). |
| T+1min | OfficeHome | MFA completed (AiTM with non-phishing resistant MFA) followed by error 50140 for the keep-me-signed-in interruption. |
| T+1min | OfficeHome | Authentication succeeded, establishing the session used for subsequent access. |
| T+2min | My Apps | The session enumerated applications assigned to the compromised identity. |
| T+2min | My Profile | Organizational profile information was accessed. |
| T+3min | Microsoft Approval Management | Identity and approval-related services were accessed. This could expose approval workflows available to the identity. |
| T+3min | Microsoft Account Controls V2 | Account and authentication management interfaces were accessed. |
| T+4min | My SignIns | Sign-in and security information was accessed through Microsoft Graph using the same source context, session, Chrome user agent, and browser ID as the OfficeHome authentication. |
| T+10min | OCaaS | The organizational application catalogue was loaded through My Apps. In this sequence, OCaaS supports application discovery rather than appearing as an isolated background event. |
| T+11 – T+50min | SharePoint Online | The session requested access to organizational sites and document resources. The sign-in events do not prove that a document was opened or downloaded. |
| T+11 – T+50min | Outlook Web | Mailbox-related services were accessed, creating an opportunity for mailbox and business-context reconnaissance. |
| T+12min | Windows App – Web | The session entered the Azure Virtual Desktop authentication flow. A desktop or remote workspace launch was not confirmed. |
| T+14min | Internal virtual application and desktop portal | Authentication succeeded to the internal virtual application and desktop portal. This could expose published applications and virtual desktops assigned to the identity, although no internal virtual application and desktop portal resource launch was confirmed. |
| T+15min | OwaDownloadAttachments | Outlook successfully requested the attachment download resource. This is more consequential than generic mailbox access, but the sign-in telemetry does not prove that an attachment was downloaded. |
| T+16min | M365ChatClient | Microsoft 365 collaboration, Teams, and search services were accessed. |
| T+16min | Internal business workflow application | Authentication succeeded to another internal business workflow application. |
Step 5 : New MFA device for persistence
Following initial access, the actor’s first objective was to transform a temporary compromise into a persistent foothold. Rather than relying solely on stolen credentials, the actor enrolled an MFA method under their control, typically by registering a new phone number, authenticator application, or software-based one-time password (OTP) token. This effectively inserted an actor-controlled factor into the victim’s identity, allowing future authentication challenges to be satisfied without the user’s involvement.
By registering an actor-controlled MFA method, the threat actor ensured that future authentication challenges could be satisfied using a factor they controlled. While MFA enrollment alone does not survive a complete credential and session reset, it provides a durable persistence mechanism when combined with stolen tokens, unrevoked sessions, or subsequent access to valid credentials. As a result, actors frequently establish MFA persistence early in the intrusion to increase the likelihood of maintaining long-term access to the compromised identity.
Phone or authenticator device addition
Detects a newly registered MFA device with a populated device token. The query compares the previous and updated authentication method values and returns newly added device records.
CloudAppEvents
| where ActionType == "Update user."
| where tostring(RawEventData.ResultStatus) == "Success"
| where RawEventData has_any ("StrongAuthenticationPhoneAppDetail", "StrongAuthenticationUserDetails")
| extend AccountObjectId = extract(@"User_([a-f0-9\-]+)", 1, tostring(RawEventData.Target))
| where isnotempty(AccountObjectId)
| mvexpand ModifiedProp = RawEventData.ModifiedProperties
| where tostring(ModifiedProp.Name) in ("StrongAuthenticationPhoneAppDetail", "StrongAuthenticationUserDetails")
| extend OldValue = tostring(ModifiedProp.OldValue),
NewValue = tostring(ModifiedProp.NewValue)
| extend OldDeviceCount = countof(OldValue, @"""Id"""),
NewDeviceCount = countof(NewValue, @"""Id""")
| where NewDeviceCount > OldDeviceCount
Software token addition
Below is a real-world example of attacker controlled Software token added to the user’s identity with Update user operation. This is added as a second NewValue entry containing the device name NO_DEVICE, device token NO_DEVICE_TOKEN, and the SoftwareTokenActivated device tag.
{
[EF1.1][KR1.2] "Id": "[GUID_REDACTED]",
"CreationTime": "2026-09-04T16:57:42.0000000Z",
"OrganizationId": "[GUID_REDACTED]",
"Operation": "Update user.",
"RecordType": 8,
"Workload": "AzureActiveDirectory",
"ResultStatus": "Success",
"UserKey": "Not Available",
"UserId": "ServicePrincipal_[GUID_REDACTED]",
"Version": 1,
"UserType": 4,
"ObjectId": "[EMAIL_REDACTED]",
"ModifiedProperties": [
{
"Name": "StrongAuthenticationPhoneAppDetail",
"OldValue": [
{
"DeviceName": "[DEVICE_NAME_REDACTED]",
"DeviceToken": "[DEVICE_TOKEN_REDACTED]",
"DeviceTag": "iOS",
"PhoneAppVersion": "6.8.53",
"OathTokenTimeDrift": 0,
"DeviceId": "[GUID_REDACTED]",
"Id": "[GUID_REDACTED]",
"TimeInterval": 0,
"AuthenticationType": 3,
"NotificationType": 2,
"LastAuthenticatedTimestamp": "2026-09-04T16:54:47.6425033Z",
"AuthenticatorFlavor": "Authenticator",
"HashFunction": null,
"TenantDeviceId": null,
"SecuredPartitionId": 20111,
"SecuredKeyId": 7
}
],
"NewValue": [
{
"DeviceName": "[DEVICE_NAME_REDACTED]",
"DeviceToken": "[DEVICE_TOKEN_REDACTED]",
"DeviceTag": "iOS",
"PhoneAppVersion": "6.8.53",
"OathTokenTimeDrift": 0,
"DeviceId": "[GUID_REDACTED]",
"Id": "[GUID_REDACTED]",
"TimeInterval": 0,
"AuthenticationType": 3,
"NotificationType": 2,
"LastAuthenticatedTimestamp": "2026-09-04T16:54:47.6425033Z",
"AuthenticatorFlavor": "Authenticator",
"HashFunction": null,
"TenantDeviceId": null,
"SecuredPartitionId": 20111,
"SecuredKeyId": 7
},
{
"DeviceName": "NO_DEVICE",
"DeviceToken": "NO_DEVICE_TOKEN",
"DeviceTag": "SoftwareTokenActivated",
"PhoneAppVersion": "NO_PHONE_APP_VERSION",
"OathTokenTimeDrift": 0,
"DeviceId": "[GUID_REDACTED]",
"Id": "[GUID_REDACTED]",
"TimeInterval": 0,
"AuthenticationType": 2,
"NotificationType": 1,
"LastAuthenticatedTimestamp": "2026-09-04T16:57:42.4514487Z",
"AuthenticatorFlavor": "Authenticator",
"HashFunction": "hmacsha1",
"TenantDeviceId": null,
"SecuredPartitionId": 20111,
"SecuredKeyId": 7
}
]
},
{
"Name": "Included Updated Properties",
"OldValue": "",
"NewValue": "StrongAuthenticationPhoneAppDetail"
},
{
"Name": "TargetId.UserType",
"OldValue": "",
"NewValue": "Member"
}
]
}
Step 6 : Graph reconnaissance
Once MFA persistence was established, the actor initiated an extensive internal reconnaissance phase using Microsoft Graph to inventory users, groups, permissions, resources, and accessible content across the tenant with the compromised identity. The actor deliberately rotated infrastructure throughout the attack lifecycle, with separate IP addresses often used for authentication, reconnaissance, and exfiltration activities. As a result, piecing together the full intrusion required correlating activity across multiple stages rather than relying on individual network indicators.
The attack underscores a critical detection challenge: Microsoft Graph abuse rarely appears suspicious when viewed through a single API call. Requests to endpoints such as /users, /groups, or /sites are commonplace in enterprise environments. However, when the same identity, application, or access token systematically traverses multiple tenant resources, evaluates privilege and authentication settings, and subsequently accesses mail, files, attachments, or document content, those actions collectively form a clear reconnaissance-to-exfiltration chain. This attack serves as a strong example of why Graph activity must be assessed holistically, with emphasis on behavioral progression and cross-event correlation rather than individual API requests in isolation.
Graph reconnaissance pattern matrix initiated by the actor
| Recon pattern | Graph URI examples | What it reveals | Why it matters |
| Tenant profile | /organization, /subscribedSkus, /licenseDetails | Identifies the tenant, verified domains, licenses, and enabled services. | Useful setup activity; stronger when followed by user, role, or repository discovery. |
| Directory enumeration | /users, /groups, /members, /transitiveMembers | Builds a map of identities, groups, and effective membership. | Can identify targets, privileged users, and sensitive collaboration groups. |
| Privilege and MFA discovery | /directoryRoles, /roleManagement, /authentication/methods | Inspects privileged assignments and registered authentication methods. | High-value reconnaissance around identity control and persistence. |
| Application and consent discovery | /applications, /servicePrincipals, /oauth2PermissionGrants, /appRoleAssignments | Maps enterprise applications, OAuth grants, and delegated or app-only access. | Can expose reusable access paths and high-value service identities. |
| SharePoint and OneDrive discovery | /sites, /lists, /drives, /drive/items, /root/children, /search | Locates sites, document libraries, folders, and files. | Often converts broad tenant reconnaissance into a collection-ready file map. |
| Mailbox discovery | /messages, /mailFolders, /attachments | Enumerates messages, folders, and attachment metadata. | Supports intelligence collection, business email compromise (BEC), and targeted attachment retrieval. |
| Automation and pagination | $top, $skip, $skiptoken, $count, /delta, /search | Walks large result sets or repeatedly searches repositories. | Raises confidence when combined with broad discovery or sensitive endpoints. |
| Content collection | /content, message or attachment retrieval, large ResponseSize | Retrieves the underlying data after discovery. | Strongest indicator that reconnaissance has progressed into collection. |
Hunt for broad Graph reconnaissance in one session
Find identities or applications touching several reconnaissance categories from the same IP within 30 minutes.
let Lookback = 24h; [MI25.1][IM25.2]
GraphAPIAuditEvents
| where Timestamp > ago(Lookback)
| where toint(ResponseStatusCode) between (200 .. 299)
| extend Uri = tolower(RequestUri),
ActorId = coalesce(AccountObjectId,
ServicePrincipalId, ApplicationId),
Path = tostring(split(tolower(RequestUri), "?")[0])
| extend ReconType = case(
Uri has "/organization" or Uri has "/subscribedskus", "Tenant",
Uri has "/users" or Uri has "/groups", "Directory",
Uri has "/directoryroles" or Uri has "/rolemanagement", "Privilege",
Uri has "/applications" or Uri has "/serviceprincipals"
or Uri has "/oauth2permissiongrants", "Application",
Uri has "/sites" or Uri has "/drive", "Repository",
Uri has "/messages" or Uri has "/mailfolders", "Mailbox",
"Other")
| where ReconType != "Other" and isnotempty(ActorId)
| summarize Requests=count(), Categories=dcount(ReconType),
DistinctPaths=dcount(Path),
ReconTypes=make_set(ReconType, 10),
SampleUris=make_set(RequestUri, 10)
by ActorId, IpAddress, ApplicationId, bin(Timestamp, 30m)
| where Requests >= 10 and Categories >= 3 and DistinctPaths >= 6
| order by Categories desc, Requests desc
Hunt for privilege, MFA, application, and consent discovery
Highlight sensitive control-plane reconnaissance that can expose persistence or escalation opportunities.
GraphAPIAuditEvents
| where Timestamp > ago(24h)
| where toint(ResponseStatusCode) between (200 .. 299)
| extend Uri = tolower(RequestUri),
ActorId = coalesce(AccountObjectId,
ServicePrincipalId, ApplicationId)
| where Uri has_any ("/directoryroles", "/rolemanagement",
"/authentication/methods", "/applications",
"/serviceprincipals", "/oauth2permissiongrants",
"/approleassign")
| summarize Requests=count(), DistinctPaths=dcount(tostring(split(Uri, "?")[0])),
ScopesSeen=make_set(Scopes, 10),
SampleUris=make_set(RequestUri, 12)
by ActorId, IpAddress, ApplicationId, bin(Timestamp, 30m)
| where Requests >= 4 and DistinctPaths >= 2
| order by Requests desc
Hunt for SharePoint and OneDrive repository discovery
Detect search, child traversal, delta queries, and paging used to map file repositories.
GraphAPIAuditEvents
| where Timestamp > ago(24h)
| where toint(ResponseStatusCode) between (200 .. 299)
| extend Uri = tolower(RequestUri),
ActorId = coalesce(AccountObjectId,
ServicePrincipalId, ApplicationId),
Path = tostring(split(tolower(RequestUri), "?")[0])
| where Uri has_any ("/sites", "/drives", "/drive/")
| where Uri has_any ("/search", "/children", "/delta",
"$skiptoken", "%24skiptoken", "$top", "%24top")
| summarize Requests=count(), DistinctPaths=dcount(Path),
SampleUris=make_set(RequestUri, 12)
by ActorId, IpAddress, ApplicationId, bin(Timestamp, 20m)
| where Requests >= 8 and DistinctPaths >= 4
| order by Requests desc
Hunt for mailbox and attachment reconnaissance
Find concentrated enumeration of messages, mail folders, and attachments.
GraphAPIAuditEvents
| where Timestamp > ago(24h)
| where toint(ResponseStatusCode) between (200 .. 299)
| extend Uri = tolower(RequestUri),
ActorId = coalesce(AccountObjectId,
ServicePrincipalId, ApplicationId),
Path = tostring(split(tolower(RequestUri), "?")[0])
| where Uri has_any ("/messages", "/mailfolders", "/attachments")
| summarize Requests=count(),
DistinctPaths=dcount(Path),
MessageRequests=countif(Uri has "/messages"),
AttachmentRequests=countif(Uri has "/attachments"),
TotalResponseBytes=sum(coalesce(ResponseSize, 0)),
SampleUris=make_set(RequestUri, 12)
by ActorId, IpAddress, ApplicationId, bin(Timestamp, 30m)
| where (Requests >= 8 and DistinctPaths >= 4) or AttachmentRequests >= 3
| order by AttachmentRequests desc, Requests desc
Step 7-8 : High-volume cloud data collection and suspected exfiltration
Following reconnaissance, the actor transitioned into large-scale data collection across Microsoft 365 workloads using the compromised identities. Microsoft observed high-volume access and download activity targeting Microsoft SharePoint Online and Microsoft OneDrive for Business, with some intrusions extending into Microsoft Exchange Online through REST API-based access to email content. Across SharePoint and OneDrive, the activity generated significant volumes of FileAccessed and FileDownloaded events, indicating systematic retrieval of cloud-hosted documents and organizational data.
The activity frequently exhibited characteristics of automation rather than interactive user behavior. In several cases, Microsoft observed the python-httpx user agent associated with high-volume SharePoint and OneDrive access patterns. However, the user agent alone should not be treated as malicious. Instead, such activity should be evaluated in the broader context of data volume, affected identities, source infrastructure, prior reconnaissance activity, and evidence of identity compromise.
Unlike rapid smash-and-grab operations, data exfiltration was typically measured and sustained, often spanning several hours to multiple days depending on the volume of files and email content available to the compromised user. The actors generally maintained a controlled pace of collection, with fewer than 1,000 files or emails accessed within any one-hour period, likely helping the activity blend with normal enterprise usage while enabling the gradual extraction of large amounts of sensitive data over time.
Hunt for exfiltration through Exchange Online
Exfiltration of data through REST API using Microsoft Office or One Outlook Web
CloudAppEvents
| where isempty(AccountObjectId)
| where ApplicationId == '20893'
| where AccountDisplayName in ("One Outlook Web", "9199bf20-a13f-4107-85dc-02114787ef48", "d3590ed6-52b3-4102-aeff-aad2292ab01c")
| where isnotempty(IPAddress)
| extend AccountObjectId = tostring(RawEventData.TokenObjectId)
| summarize ExchangeRestEventCount=count() by IPAddress, AccountObjectId, bin(Timestamp,1h)
| where ExchangeRestEventCount >= 500
Hunt for exfiltration through Microsoft SharePoint Online, OneDrive for Business
Exfiltration of data through python-httpx user agent
CloudAppEvents
| where ApplicationId == "20892" or ApplicationId == "15600"
| where ActionType in ("FileDownloaded", "FileAccessed", "SyncDownloadedFull")
| where isnotempty(AccountObjectId)
| where isnotempty(IPAddress)
| where isnotempty(UserAgent)
| where UncommonForUser has_any("ISP","UserAgent")
| where UserAgent has 'python-httpx'
| project Timestamp, AccountObjectId, IPAddress, ISP, UserAgent
| summarize FilesAccessedLastWindow = count() by AccountObjectId, IPAddress, ISP, UserAgent, bin(Timestamp,2h)
| where FilesAccessedLastWindow >=100
Hunt for anomalous high-volume exfiltration
Exfiltration of data through anonymous proxy
CloudAppEvents
| where ApplicationId in (20892, 20893, 15600)
| where ActionType in~ ("FileDownloaded", "FileAccessed", "FilePreviewed")
| where IsAnonymousProxy == true
| where UserAgent !has "ODMTADemand"
| extend FileSizeBytes = coalesce(tolong(RawEventData.FileSizeBytes), 0)
| summarize
FileSizeBytes = sum(FileSizeBytes),
FirstSeen = min(Timestamp),
LastSeen = max(Timestamp),
EventCount = count(),
ActionTypes = make_set(ActionType),
Applications = make_set(Application)
by AccountObjectId, IPAddress,
TimeBucket = bin(Timestamp, 2h), UserAgent, ISP
| extend FileSizeGB =
round(FileSizeBytes / 1024.0 / 1024.0 / 1024.0, 2)
| where FileSizeGB >= 5 or EventCount >= 1000
| order by EventCount desc
Attribution
Microsoft Threat Intelligence assesses that the initial access activity observed in this campaign is used by a range of threat actors, including Storm-3121, Storm-3032, and others. Storm-3121 conducts initial access activity leading to ShinyHunters and Falcon extortion. Storm-3032 represents a set of actors that splintered from the BlackFile group and now operate under the Helix extortion banner. That being said, Microsoft Defender has detection coverage for the known tactics, techniques and procedures from Storm-3121, Storm-3032 and other operators in the same ecosystem.
Mitigation and protection guidance
Microsoft recommends that organizations investigate identity and cloud-workload signals as a connected sequence, with priority given to unusual sign-ins followed bys authentication method enrollment, Microsoft Graph reconnaissance, token issuance, and abnormal SaaS download or mailbox activity.
Investigate
- Review newly registered authentication methods and devices for users with risky or unusual sign-ins and remove unauthorized methods after validating the user.
- Investigate high-volume or programmatic Microsoft Graph activity involving directory enumeration, role discovery, service principal discovery, SharePoint, OneDrive, or sensitivity-label discovery.
- Correlate SharePoint and OneDrive download anomalies, Exchange REST activity, and mailbox or attachment searches with identity and authentication events.
Contain and remediate
- Revoke active sessions and refresh tokens for confirmed compromised identities, reset credentials, remove attacker-registered authentication methods, remove attacker created mailbox rules, and require secure re-registration of authentication methods.
Reduce future risk
- Do not treat an IP or domain match as conclusive on its own. Validate workload behavior, affected identities, persistence events, and data access volume.
- Enforce phishing-resistant MFA (FIDO2/passkeys, Windows Hello for Business) via Conditional Access
- Enforce Conditional Access that requires a managed, compliant device for Exchange, SharePoint, and Graph-privileged apps
- Enforce strict conditional access controls for security info registration, including setting required sign-in frequency to always (require a new interactive auth), requiring managed devices and/or named locations, and requiring phish-resistant MFA as a required authentication strength, and in a separate policy blocking security info registration with a high sign-in risk condition
- Enforce risk-based access policies for risky sign-ins and risky users – remediate elevated risk with phishing-resistant MFA or secure password change, and block access at the highest risk levels.
- Train users against voice and email phishing that targets MFA and passkey enrollment. Provide a verified channel to report unsolicited authentication requests.
- Block the device code and authentication transfer flows via Conditional Access, except where an explicit business need exists.
- Restrict user consent for applications, require admin approval, and regularly review service principals holding high-privilege Graph permissions such as Mail.Read, Files.Read.All, and Directory.Read.All.
- Limit access from unmanaged devices to web-only sessions without download or sync, and disable anonymous sharing links in SharePoint and OneDrive.
- Enable Microsoft Graph activity logs and mailbox auditing, and alert on anomalous enumeration, authentication-method registration, and high-volume file or mail access.
- Educational training: Verify user identity through a rigorous process before performing any helpdesk-initiated credential or MFA reset, and alert on every such reset.
Microsoft Defender XDR detections
Microsoft Defender XDR customers can refer to the list of applicable detections below. Microsoft Defender XDR coordinates detection, prevention, investigation, and response across endpoints, identities, email, and apps to provide integrated protection against attacks like the threat discussed in this blog.
Customers with provisioned access can also use Microsoft Security Copilot in Microsoft Defender to investigate and respond to incidents, hunt for threats, and protect their organization with relevant threat intelligence.
| Tactic | Observed activity | Microsoft XDR Defender coverage |
| Credential Access | Unusual cloud activity from a tracked potentially malicious IP | Microsoft Defender for Cloud – A storage account was accessed from a suspicious IP address. Microsoft Defender for Identity – Malicious registration of a device with strong MFA. – Malicious registration of an attacker controlled MFA device. – Suspicious registration of a new Authenticator MFA method. – Malicious registration of a new Authenticator MFA method. – Suspicious registration of a new Phone MFA method. – Malicious registration of a new Phone MFA method – Malicious registration of a new Email MFA method. Microsoft Defender XDR – Malicious sign in from an IP address associated with recognized attacker infrastructure. |
| Discovery | Graph API reconnaissance activity | Microsoft Defender for Identity – Suspicious Entra Graph API query observed. |
| Exfiltration | Data exfiltration activity | Microsoft Defender for Cloud – Unusual number of blobs extracted from a storage blob container. – Unusual amount of data extracted from a storage file share. – Unusual number of files extracted from a storage file share. – Unusual amount of data extracted from a sensitive blob container. – Unusual number of blobs extracted from a sensitive blob container. – Unusual amount of data extracted from a sensitive storage file share. – Unusual number of files extracted from a sensitive storage file share. – Sensitive data was exfiltrated from a publicly exposed blob container. Microsoft Defender XDR – Automated mass SharePoint/OneDrive file access via python-httpx. |
Microsoft Security Copilot
Security Copilot customers can use the standalone experience to create their own prompts or run the following prebuilt promptbooks to investigate activity associated with this intrusion pattern:
- Incident investigation – Generates investigation summaries and helps analysts understand incidents involving compromised identities, suspicious sign-ins, persistence activity, and cloud-based data access.
- Microsoft User analysis – Analyses user accounts, sign-in activity, authentication events, risk indicators, and related identity signals that may help identify compromised accounts.
Customers can also use Microsoft Security Copilot together with Microsoft Threat Intelligence to investigate indicators, threat activity, and related intelligence associated with suspicious sign-ins, Microsoft Graph reconnaissance, and cloud data exfiltration activity.
Note that some promptbooks require access to plugins for Microsoft products such as Microsoft Defender XDR or Microsoft Sentinel.
Threat intelligence reports
Microsoft customers can use the following reports in Microsoft products to get the most up-to-date information about the threat actor, malicious activity, and techniques discussed in this blog. These reports provide intelligence, protection information, and recommended actions to prevent, mitigate, or respond to associated threats found in customer environments.
MITRE ATT&CK Techniques observed
Reconnaissance
- T1591 Gather Victim Org Information | Use of themed domains for credential phishing pages
- T1598.003 Phishing for Information: Spear-phishing Link | Use of spear-phishing emails with links to spoofed sign-in pages
Resource Development
- T1583.001 Acquire Infrastructure: Domains | Use of themed domains for credential phishing pages
- T1585.002 Establish Accounts: Email Accounts | Delivery infrastructure that is comprised of accounts from consumer email providers like Hotmail
Initial Access
- T1078.004 Valid Accounts: Cloud Accounts | The compromised cloud identity is used to authenticate to Microsoft cloud services.
Persistence
- T1556.006 Modify Authentication Process: Multi-Factor Authentication | After gaining account access, the threat actor registers a new authentication method, mobile device, or software-based OTP to establish persistent access to the compromised identity.
Discovery
- T1087.004 Account Discovery: Cloud Account | The threat actor uses Microsoft Graph to enumerate tenant users and identities, including information useful for identifying high-value identities and privileged accounts.
- T1069.003 Permission Groups Discovery: Cloud Groups | Microsoft Graph reconnaissance enumerates group memberships and directory roles, allowing the threat actor to understand privilege relationships and identify potentially valuable identities.
Collection
- T1530 Data from Cloud Storage | The actor searches and accesses SharePoint and OneDrive content and performs high-volume file access/download activity to collect targeted cloud-hosted information.
- T1114 Email Collection | Mailboxes, messages, and attachments are searched for material of interest and email is collected through REST APIs.
- T1213 Data from Information Repositories | The actor searches enterprise cloud repositories, including SharePoint content and other organizational cloud data, to identify information of value for collection.
Exfiltration
- T1567 Exfiltration Over Web Service | The campaign performs high-volume cloud data access and uses automated Python-based activity for rapid collection and exfiltration.
Advanced hunting queries
Additional advanced hunting query for Graph reconnaissance:
Hunt for automated pagination, delta, and search behavior
Identify actors walking large Graph result sets or repeatedly querying for data.
GraphAPIAuditEvents
| where Timestamp > ago(24h)
| where toint(ResponseStatusCode) between (200 .. 299)
| extend Uri = tolower(RequestUri),
ActorId = coalesce(AccountObjectId,
ServicePrincipalId, ApplicationId),
Path = tostring(split(tolower(RequestUri), "?")[0])
| where Uri has_any ("$top", "%24top", "$skip", "%24skip",
"$skiptoken", "%24skiptoken", "$count",
"%24count", "/delta", "/search")
| summarize AutomatedRequests=count(), DistinctPaths=dcount(Path),
SampleUris=make_set(RequestUri, 12)
by ActorId, IpAddress, ApplicationId, bin(Timestamp, 15m)
| where AutomatedRequests >= 8 and DistinctPaths >= 4
| order by AutomatedRequests desc
Hunt for reconnaissance progressing to content collection
Prioritize sessions where broad discovery and content retrieval occur together.
GraphAPIAuditEvents
| where Timestamp > ago(24h)
| where toint(ResponseStatusCode) between (200 .. 299)
| extend Uri = tolower(RequestUri),
ActorId = coalesce(AccountObjectId,
ServicePrincipalId, ApplicationId)
| extend ActivityType = case(
Uri has "/content" or Uri has "/attachments", "ContentCollection",
Uri has "/users" or Uri has "/groups", "DirectoryRecon",
Uri has "/directoryroles" or Uri has "/rolemanagement"
or Uri has "/authentication/methods", "PrivilegeRecon",
Uri has "/applications" or Uri has "/serviceprincipals", "ApplicationRecon",
Uri has "/sites" or Uri has "/drives" or Uri has "/drive/", "RepositoryRecon",
Uri has "/messages" or Uri has "/mailfolders", "MailboxRecon",
"Other")
| where ActivityType != "Other"
| summarize DiscoveryFirst=minif(Timestamp, ActivityType != "ContentCollection"),
CollectionFirst=minif(Timestamp, ActivityType == "ContentCollection"),
DiscoveryCategories=dcountif(ActivityType, ActivityType != "ContentCollection"),
ContentRequests=countif(ActivityType == "ContentCollection"),
TotalResponseBytes=sum(coalesce(ResponseSize, 0)),
SampleUris=make_set(RequestUri, 15)
by ActorId, IpAddress, ApplicationId, bin(Timestamp, 1h)
| where isnotnull(DiscoveryFirst) and isnotnull(CollectionFirst)
| where CollectionFirst >= DiscoveryFirst
and DiscoveryCategories >= 2 and ContentRequests >= 1
| order by CollectionFirst desc
Hunt for exfiltration through Microsoft Graph
Prioritize sessions where broad discovery and content retrieval occur together.
GraphAPIAuditEvents
| where Timestamp > ago(24h)
| where toint(ResponseStatusCode) between (200 .. 299)
| extend Uri = tolower(RequestUri),
ActorId = coalesce(AccountObjectId,
ServicePrincipalId, ApplicationId)
| extend ActivityType = case(
Uri has "/content" or Uri has "/attachments", "ContentCollection",
Uri has "/users" or Uri has "/groups", "DirectoryRecon",
Uri has "/directoryroles" or Uri has "/rolemanagement"
or Uri has "/authentication/methods", "PrivilegeRecon",
Uri has "/applications" or Uri has "/serviceprincipals", "ApplicationRecon",
Uri has "/sites" or Uri has "/drives" or Uri has "/drive/", "RepositoryRecon",
Uri has "/messages" or Uri has "/mailfolders", "MailboxRecon",
"Other")
| where ActivityType != "Other"
| summarize DiscoveryFirst=minif(Timestamp, ActivityType != "ContentCollection"),
CollectionFirst=minif(Timestamp, ActivityType == "ContentCollection"),
DiscoveryCategories=dcountif(ActivityType, ActivityType != "ContentCollection"),
ContentRequests=countif(ActivityType == "ContentCollection"),
TotalResponseBytes=sum(coalesce(ResponseSize, 0)),
SampleUris=make_set(RequestUri, 15)
by ActorId, IpAddress, ApplicationId, bin(Timestamp, 1h)
| where isnotnull(DiscoveryFirst) and isnotnull(CollectionFirst)
| where CollectionFirst >= DiscoveryFirst
and DiscoveryCategories >= 2 and ContentRequests >= 1
| order by CollectionFirst desc
Indicators of compromise (IOC)
| Indicators | Type | Description |
| passkeyhelpdesk[.]com | Domains | Passkey support lure |
| secure-passkey[.]com | Domains | Passkey security |
| setupmypasskey[.]com | Domains | Passkey setup |
| add-passkey[.]com | Domains | Passkey enrollment |
| integratedsso[.]com | Domains | SSO |
| oktasession[.]com | Domains | Identity-provider session |
| keysyncos[.]com | Domains | Key synchronization |
| oskeysync[.]com | Domains | Key synchronization |
| oskeysetup[.]com | Domains | Key setup |
| oskeyregister[.]com | Domains | Key registration |
| syncmykey[.]com | Domains | Key synchronization |
| myconnectkey[.]com | Domains | Key connection |
| oskeyconnect[.]com | Domains | Key connection |
| validationsetupac[.]com | Domains | Account validation and setup |
| portalsetuphub[.]com | Domains | Portal setup |
Learn more
For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.
To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky.
To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.
Review our documentation to learn more about our real-time protection capabilities and see how to enable them within your organization.
- Evaluate your AI readiness with our latest Zero Trust for AI workshop.
- Microsoft 365 Copilot AI security documentation
- How Microsoft discovers and mitigates evolving attacks against AI guardrails
- Learn more about securing Copilot Studio agents with Microsoft Defender