Arctic Wolf reports a wave of phone-based social engineering where attackers pose as internal IT, guide executives through “routine” MFA/passkey setup, and then send a company-branded login link that steals Microsoft 365 credentials and session tokens. Once inside, attackers methodically inventory SharePoint/OneDrive/Exchange and then perform bulk data theft, followed by extortion.
This social engineering campaign begins with a phone call, not an email. The caller claims to be internal IT and walks the employee through what sounds like a routine passkey or MFA setup. Once trust is established, the caller sends a link to an authentication page styled to look like the victim's own company portal, frequently hosted on a subdomain that carries the company's name. Behind that page sits an adversary-in-the-middle panel, manually gated per victim, that stages the real Microsoft 365 login flow, captures the password and MFA approval, and lifts an authenticated session token. The targets are primarily US-based and heavily skew toward Directors, Vice Presidents, and other executive staff.
The attack blends a live human interaction with a technically convincing web flow. A phone call from someone claiming to be IT carries built-in authority, and framing the request as routine MFA or passkey setup lowers suspicion since it mirrors legitimate onboarding processes many employees have experienced before. Because the phishing page is branded to look like the company's own sign-in portal and hosted on a lookalike subdomain, visual inspection alone is unlikely to catch it. The session token theft also bypasses the protection MFA is meant to provide, since the token is captured after the victim completes authentication.
Once attackers have a valid session, they move methodically rather than immediately grabbing data. They first review account and app details through pages like My Sign-ins, My Profile, and My Apps. From there they search through SharePoint site by site and page by page to map what is stored before copying anything. The final step is bulk collection and exfiltration from SharePoint, OneDrive, Exchange, and other SaaS providers such as Box, which precedes extortion. Sign-ins and downloads are routed through residential proxies, which complicates detection by making the traffic look like it originates from ordinary consumer networks.
Organizations should train help-desk staff and end users to treat unexpected IT calls about authentication changes as suspicious and verify them through a known internal number or ticketing system. Employees should be reminded to never sign in through a link sent during a phone call, instead navigating to Microsoft 365 directly. Tightening Conditional Access policies to challenge or block proxy and hosting traffic reduces the value of a stolen token, and monitoring for anomalous residential-proxy token replay alongside bulk file access patterns can help defenders catch the intrusion before mass exfiltration and extortion occur.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They call employees, often executives, claiming to be internal IT and walk them through what sounds like routine passkey or MFA setup, then send a company-branded authentication link.
An adversary-in-the-middle panel captures the password and MFA approval and uses them to pull an authenticated session token, giving attackers direct access to Microsoft 365.
They first review account pages like My Sign-ins and My Apps, then systematically enumerate SharePoint site by site before performing bulk collection and exfiltration from SharePoint, OneDrive, Exchange, and other SaaS platforms such as Box.
Watch for high volumes of FileAccessed and FileDownloaded events, MailItemsAccessed spikes, and sign-ins or downloads originating from residential proxy IPs rather than expected corporate locations.
Imagine this: you pick up the phone and hear, “Hi, this is IT. We need to walk you through a routine passkey and MFA setup.” They text you a link to what looks like our company Microsoft 365 sign-in page, even using our name in the subdomain. You log in, approve MFA while they’re on the line… and they quietly steal your password and session token. With that session, they open My Sign-ins, My Profile, My Apps, then crawl SharePoint site by site before bulk-downloading files from SharePoint, OneDrive, Exchange, even Box, often from residential proxy IPs that don’t look obviously bad. Your move: if “IT” calls you out of the blue to set up MFA or passkeys and sends a login link, hang up, go to our normal M365 portal or bookmark yourself, and contact IT using our official help-desk channel.
Threat actors are calling employees while pretending to be internal IT/help desk staff and directing them to fake Microsoft 365 login pages. The goal is to capture credentials and MFA approvals, steal session tokens, then access and exfiltrate data from SaaS services like SharePoint, OneDrive, and…
A criminal group tracked as UNC6671 called employees while pretending to be their company IT helpdesk, creating urgency around “mandatory” security changes. Victims were directed to lookalike login pages to “enable passkeys” or “update MFA,” allowing attackers to steal passwords and capture…
Google says the BlackFile extortion group (UNC6671) rebranded to “Redact” while keeping the same core scam: phone calls that impersonate IT helpdesk staff and push “urgent security migrations.” Victims are directed to spoofed login pages that steal passwords and MFA codes, enabling attackers to…
This bulletin describes multiple real-world social engineering campaigns where attackers trick people into trusting a familiar screen, like a search result “install guide,” a recruiter outreach, or a helpdesk phone call. The lures push victims to paste commands, install fake software, or reset MFA,…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
This news roundup describes real social-engineering operations where attackers impersonate trusted support teams to trick people into giving up secrets. One campaign uses email/SMS/WhatsApp plus AI voice calls pretending to be Apple Support to steal iPhone passcodes, while another uses phishing…
