Microsoft reported that hacker groups, including ShinyHunters and Helix, are using social engineering to compromise corporate Microsoft 365 accounts. Attackers impersonate IT support staff, contacting employees via phone or messaging to demand urgent updates to Passkey, MFA, or SSO configurations.
The attackers direct victims to phishing websites that mimic official Microsoft login pages. These sites use Adversary-in-the-Middle (AiTM) techniques to intercept user credentials and session tokens. In some cases, attackers use device code phishing to obtain OAuth authentication tokens, bypassing MFA requirements.
Once access is gained, attackers use automated Node.js systems and Microsoft Graph to conduct reconnaissance. They enumerate organizational data, including user roles, SharePoint sites, OneDrive files, and email contents. Attackers often establish persistence by adding their own MFA methods, such as new phone numbers or authenticator apps.
Data exfiltration is automated to avoid detection, with attackers typically accessing fewer than 1,000 files or emails per hour. This allows them to blend in with normal traffic over periods ranging from several hours to several days. Compromised accounts can grant access to connected platforms like Salesforce, Slack, and SAP.
Microsoft advises organizations to monitor for suspicious login events, new MFA registrations, and unusual Microsoft Graph activity. Recommended defenses include using phishing-resistant MFA, restricting access to managed devices, and disabling device code authentication where it is not required for business operations.
