As cited
Copy frozen at (site build).
threat intel
Attackers call employees’ personal phones to break into Microsoft 365 accounts
Attackers are conducting a social engineering campaign that targets employees on personal phones, impersonating internal IT staff to obtain Microsoft 365 credentials. Once authenticated, threat actors gain extended access to cloud applications, email, SharePoint, and OneDrive to exfiltrate files and messages. Microsoft Security Research has been monitoring the campaign since May 2026.
Why it matters: Organizations with Microsoft 365 deployments face immediate risk of credential compromise through voice and text social engineering on personal devices, enabling attackers to steal sensitive corporate data without traditional network detection.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Attackers call employees’ personal phones to break into Microsoft 365 accounts
Attackers are conducting a social engineering campaign that targets employees on personal phones, impersonating internal IT staff to obtain Microsoft 365 credentials. Once authenticated, threat actors gain extended access to cloud applications, email, SharePoint, and OneDrive to exfiltrate files and messages. Microsoft Security Research has been monitoring the campaign since May 2026.
Why it matters: Organizations with Microsoft 365 deployments face immediate risk of credential compromise through voice and text social engineering on personal devices, enabling attackers to steal sensitive corporate data without traditional network detection.
- Source published
- First seen by Cybersecurity Tracker