Attackers Use Personal Phone Social‑Engineering to Hijack Microsoft 365 Accounts
What Happened – Attackers are calling or texting employees on their personal, unmanaged phones, posing as internal IT staff. By convincing users to “update” passkeys or MFA settings, they obtain valid authentication tokens and register their own MFA methods, gaining persistent access to Microsoft 365, SharePoint, OneDrive, and Teams for weeks.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous monitoring of MFA enrollment and changes – a core control‑assurance activity that provides a defensible audit trail.
- Highlights gaps in user awareness and the importance of security‑aware policies for personal‑device interactions, which are essential evidence for identity‑access governance.
- Shows that a single compromised credential can be leveraged to enumerate accounts via Microsoft Graph, underscoring the value of real‑time detection and logging of privileged API activity.
Who Is Affected – Any organization that relies on Microsoft 365 for email, file storage, or collaboration, spanning technology SaaS, financial services, healthcare, education, and government.
Recommended Actions
- Review MFA registration logs for unexpected additions (phone numbers, authenticator apps, OTP tokens).
- Enforce conditional‑access policies that require managed devices for MFA enrollment or changes.
- Deploy security‑awareness training focused on social‑engineering via personal phones and “passkey” lures.
- Enable alerts for MFA method changes and for Microsoft Graph API calls that enumerate users or groups.
- Conduct a rapid audit of existing MFA configurations against your control‑assurance framework.
Technical Notes – The attackers use phone‑based social engineering, impersonating IT staff, to deliver a phishing page that mimics Microsoft sign‑in. They then exploit the “passkey” narrative to guide victims through an adversary‑in‑the‑middle (AiTM) flow or device‑code authentication, later registering their own MFA methods for durable persistence. Activity is performed through Microsoft Graph, making detection difficult without dedicated API monitoring. Source: Help Net Security