Microsoft tracked attackers who phoned staff to breach 365 accounts.
BleepingComputer reported on 11 September 2026 on Microsoft research into a campaign running since May.
Callers pose as the IT help desk and tell employees they must update a passkey, MFA or SSO setting now.
A link then arrives by SMS, often on the employee's personal phone, and opens a page that looks like a Microsoft sign-in. Some victims enter their credentials into an adversary-in-the-middle site, which intercepts the session token. Others approve a device-code request for an application the attacker controls.
Microsoft said: "The actor appears to invest heavily in pre-attack research, likely gathering information about employees and organizational structure from public sources."
Microsoft tracks the activity as Storm-3121 and Storm-3032; Google Threat Intelligence links related activity to UNC6671.
The callers use the words your own security programme has been teaching all year: passkey, MFA, SSO.
Who is authorised to phone your staff and ask them to change an authentication setting?
Sources
Our file on Microsoft
- 4 Nov
Microsoft and Google are not in the school platform six German states agreed to buy. Nextcloud supplies the software.
- 4 Nov
Microsoft says 8 GB Windows 11 PCs will multitask up to 40% faster. IT teams buying laptops face rising memory prices.
- 3 Nov
Microsoft calendars can be an hour off after a Canadian clock change. A fix for recurring meetings has no date yet.
- 2 Nov
Microsoft, Oracle and three peers cut buybacks 83% to $13.6bn. AI spending is eating their cash, a Reuters analysis found.
- 2 Nov
Microsoft's new reseller Copilot seats can add usage charges to the $21 monthly fee. The default cap is 4,000 credits per user.
For your next steering committee
- 1Ask when systems of this kind in your landscape were last patched, and who confirms it.
- 2Ask which finance and ERP accounts can be reached from outside, and how each sign-in is protected.
- 3Ask how long a restore took the last time it was tested.
Issue 01 of the ERP LEADERS brief puts a timeline, the three-number review and six questions on one page. Read issue 01
Welcome back. · Issue 01
