Researchers describe an active, widespread email campaign that tricks employees with voicemail-themed messages and steals Microsoft 365 login sessions (including MFA codes). After taking over accounts, attackers quietly search and collect payroll/HR/finance emails and identify people involved in payment workflows, while using residential proxy logins to blend in.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get this email: “New voicemail message, sign in to listen.” Looks normal, right? It’s actually a trap for your Microsoft 365 account. You click the voicemail link, it bounces through Google Meet, Google Ads, even an Amazon S3 URL, then lands on a perfect-looking Microsoft login page that asks for your password and MFA code. That’s an adversary-in-the-middle page quietly stealing your entire session. Once they’re in, they reuse your session from residential proxies that look local, quietly search payroll, HR, and finance mailboxes, and even drop inbox rules that move certain emails to Deleted Items and mark them read so you never see the signs. Here’s the move: treat every voicemail email as high risk. If you get one, don’t click the link, open your usual Microsoft 365 or phone app directly and check voicemail there instead.
Researchers described a now-patched flaw ("AgentForger") where a single benign-looking ChatGPT link could silently create and publish an attacker-controlled Workspace Agent inside a company. If an employee was already logged in and had connected apps (like email, Drive, Slack, or Teams), the agent…
Microsoft reports a real-world campaign where attackers call or text employees’ personal phones while posing as internal IT. Victims are pushed to “update” passkeys/MFA/SSO and click a link to a fake Microsoft sign-in page, letting attackers get into Microsoft 365 and quietly pull email and files…
Microsoft disrupted EvilTokens, a phishing-as-a-service operation linked to thousands of compromised Microsoft 365 inboxes. The group used “device code” phishing to steal valid session tokens (not passwords) and then used an AI chatbot to scan mailboxes and help craft business email compromise…
Microsoft and UK police took down “EvilTokens,” an AI-powered phishing service sold on Telegram that helped criminals compromise email accounts and then rapidly find the best ways to commit fraud. The service could analyze a victim’s inbox to identify trusted relationships and financial workflows,…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service operation linked to more than 12,000 compromised Microsoft email inboxes across 10,000+ organizations. The service used AI to pick targets, impersonate trusted contacts, and steal session tokens so criminals could stay in…
Microsoft says attackers are impersonating IT support and using “passkey/MFA/SSO update” requests to trick employees into authenticating attacker-controlled sessions. The campaigns use attacker-in-the-middle phishing sites or device-code logins to capture valid session tokens, then access Microsoft…
