A Fake IT Call Is All Hackers Need to Break Into Your Microsoft 365 Account

Your Phone Rings. It's "IT Support." And Your Account Is Already Gone.

You think you're protected. You set up passkeys. You turned on MFA. Microsoft even congratulated you for it.

Then your phone rings.

Someone from "the IT help desk" explains your authentication configuration needs updating. If you don't act now, your account locks in an hour. They sound calm. Professional. They know your company name, your job title, maybe your manager's name. They send an SMS with a link to fix it yourself.

You click it. You type in your credentials. And in the background, silently, attackers capture everything, your password, your active session token, your identity. Within minutes, they add their own authentication method. You are locked out. They are in.

This is not a theoretical scenario. Microsoft's security team disclosed it on September 9, 2026. It has been running since at least May 2026, across multiple organizations.

How Does This Attack Actually Work?

The attack is called passkey-themed social engineering. The name sounds technical. The method is not.

The attacker calls you and plays the role of IT support. They tell you something is wrong with your account setup, specifically your passkey or MFA configuration. This is clever because passkeys and MFA are new enough that most people still feel uncertain about them. The "IT person" provides just enough detail to sound credible.

They send you a text with a link. The link goes to a page that looks exactly like Microsoft's sign-in portal. You log in. The fake page captures your username, password, and the session token your browser holds. Session tokens are what keep you logged in without re-entering your password constantly. Once an attacker has your session token, they don't need your password at all.

They use that token to enter your real Microsoft 365 account. Immediately, they register their own authentication method, a passkey or phone number they control. Now they have permanent access. You don't.

From there, the attackers use the Microsoft Graph API, which is the technical backbone of Microsoft 365. It lets applications read and write data across your account. They use it to map out everything you have access to: SharePoint files, OneDrive documents, Exchange emails. Then they pull it all out through Microsoft's own APIs, which look like normal application traffic to most security tools.

The groups behind these attacks, ShinyHunters and Helix extortion crews, are not amateurs. They operate at scale, with infrastructure designed to maximize damage quickly.

The Scope of What's Happening

Microsoft observed compromises across multiple organizations starting in May 2026. The September 9th disclosure confirmed the campaign is active and ongoing.

The same infrastructure powered a separate attack between August 3 and 5, 2026. Attackers sent over one million financial fraud emails impersonating CEOs, targeting companies and their finance teams. One infrastructure. Two campaigns running in parallel.

This is not a small group testing a new trick. This is a coordinated operation with real resources behind it.

What You Should Do Right Now

1. Treat unexpected IT calls as suspicious by default. Your real IT team almost never calls you out of nowhere about passkey issues. If someone does call, hang up and call your IT department back using a number from your company directory, not a number the caller gives you.

2. Never click links sent via SMS from someone who just called you. This combination, a phone call followed by a text link, is the specific pattern this attack uses. A real Microsoft service update does not arrive this way.

3. Check what authentication methods are registered on your account. Go to your Microsoft account security settings directly by typing the URL yourself, not from any link. Look at the list of registered sign-in methods. If you see anything you don't recognize, a phone number, a passkey, an authenticator app, remove it immediately and contact your IT team.

4. Enable login notifications. Microsoft 365 can notify you when a new sign-in occurs or when account security settings change. Turn this on. It gives you a window to act before attackers lock you out.

5. Use a hardware security key as your primary MFA. Hardware keys like YubiKeys cannot be phished because they verify the actual domain of the page you're on. A fake Microsoft login page cannot intercept a hardware key response. If your organization handles sensitive data, this is worth the cost.

6. Brief your team. Forward this post. Send a two-sentence Slack message. The attack works because most people don't expect it. Awareness is the cheapest defense you have.

7. If you think your account was compromised, act fast. Contact Microsoft support directly. Force a sign-out of all active sessions from your Microsoft account settings. Change your password immediately. Then audit what was accessed, especially SharePoint and OneDrive file activity logs.

The Thing That Doesn't Change

Technology companies keep raising the floor. Passkeys replaced passwords. Hardware tokens replaced SMS codes. Each upgrade was real and made attacks harder.

But none of it changes the fact that humans answer phones. Humans feel pressure when someone says their account is about to lock. Humans click links sent by people who sound like they're trying to help.

The attackers in this campaign didn't break Microsoft's authentication system. They called someone, sounded helpful, and waited.

Every security tool you add protects the door. Social engineering goes around the door entirely. The only defense that works at that point is skepticism, trained, deliberate skepticism about any unexpected contact that asks you to act quickly.

Do this today:

• Check your Microsoft 365 registered sign-in methods
• Enable account change notifications
• Share this with one person on your team

Sources

• microsoft.com
• thehackernews.com
• bleepingcomputer.com