Microsoft described two real-world campaigns: an invoice fraud blast impersonating executives to trick finance teams into ACH payments, and a passkey-themed helpdesk scam that steals or bypasses authentication to take over Microsoft cloud accounts. In the second campaign, victims are called or texted and then pushed to fake Microsoft login pages, after which attackers add their own MFA methods and quickly download email and files from SharePoint/OneDrive.
Microsoft described two distinct real-world campaigns. The first targeted Accounts Payable and Finance staff with executive impersonation emails demanding ACH transfers for a fake ServiceNow annual subscription invoice, using trusted infrastructure, fabricated invoices, and even forged supporting email threads to appear legitimate. The second campaign used passkey, MFA, and SSO themes to hijack Microsoft accounts directly. Attackers called or texted a victim's personal phone, posed as the internal IT help desk, and pushed an urgent need to update authentication settings. Victims were then redirected via SMS to counterfeit Microsoft sign-in pages, where adversary-in-the-middle or device-code authentication flows let attackers capture session access and take over the account. In some cases, already compromised accounts were used to send similar passkey-themed lures internally via Microsoft Teams.
Both campaigns relied on urgency and authority rather than technical exploits. The invoice scam borrowed real executive names and paired them with a plausible vendor renewal, giving finance staff a reason to act quickly outside normal procurement checks. The helpdesk scam exploited the fact that identity and access issues feel time sensitive: an employee told their passkey or MFA needs immediate attention is primed to comply without pausing to verify the source. Once attackers gained account control, they reinforced their access by adding their own MFA methods, making the takeover harder to notice or reverse quickly.
Employees should verify any passkey, MFA, or SSO change request through official IT channels before clicking a link or entering credentials, especially when the outreach arrives on a personal device. Finance teams should independently confirm payment requests tied to executive emails using known contacts and established procurement steps, rather than acting solely on an emailed 'approval.' Organizations can also reduce risk by training staff to recognize authentication-themed domains and by reinforcing that legitimate IT support rarely initiates urgent, unsolicited outreach about account security settings.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers call or text a user's personal phone claiming to be the organization's IT help desk, urging an urgent passkey, MFA, or SSO update. Victims are redirected via SMS to counterfeit Microsoft sign-in pages, where attackers use adversary-in-the-middle or device-code flows to take over the account.
According to the reporting, attackers add their own MFA methods to maintain persistence and then quickly collect email and files from SharePoint and OneDrive.
They are two separate campaigns described in the same report. One uses passkey/MFA/SSO pretexts to hijack Microsoft accounts, while the other impersonates CEOs to push Accounts Payable teams into ACH payments for a fake ServiceNow subscription invoice.
Red flags include a purported executive 'approval' embedded in the email, impersonation domains, fabricated invoices, and even forged supporting email threads meant to add legitimacy.
You get a call on your personal phone: “This is IT help desk, you need to update your Microsoft passkey now or you’ll lose access.” They text you a link that looks like Microsoft sign-in. You tap, see a familiar blue login page, enter your password, approve the prompt… and in the background, an adversary-in-the-middle flow hands your session to them. Now they add their own MFA method to your Microsoft account and quietly start downloading mail, SharePoint, and OneDrive files, using your session as if they were you. If anyone contacts your personal phone about passkeys, MFA, or SSO, don’t tap the link, hang up and contact our IT team through the official helpdesk channel you already use.
Microsoft reports active intrusions where attackers trick employees with “passkey/SSO update” helpdesk pretexts delivered by phone, SMS, or even Microsoft Teams. Victims are sent to lookalike Microsoft sign-in pages or guided through device-code sign-in, letting attackers capture session access and…
This news roundup describes real social-engineering operations where attackers impersonate trusted support teams to trick people into giving up secrets. One campaign uses email/SMS/WhatsApp plus AI voice calls pretending to be Apple Support to steal iPhone passcodes, while another uses phishing…
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
Researchers described a now-patched flaw ("AgentForger") where a single benign-looking ChatGPT link could silently create and publish an attacker-controlled Workspace Agent inside a company. If an employee was already logged in and had connected apps (like email, Drive, Slack, or Teams), the agent…
Researchers say a phishing-as-a-service platform called AnonyMousKIT targets people who recently lost or had an iPhone stolen by pretending to be “Apple Support.” The operation uses email/SMS/WhatsApp and AI-assisted voice calls to convince victims to share their iPhone passcode and follow a…
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
