Hackers steal Microsoft Cloud accounts by posing as IT staff

Full text

Microsoft warns of a sophisticated campaign tricking users into updating passkeys via fake IT calls

Victims redirected to adversary‑in‑the‑middle sites mimicking Microsoft login to steal access

Attackers exfiltrate files from SharePoint, OneDrive, and Exchange; phishing‑resistant MFA advised

Passkeys have made stealing passwords obsolete. To work around this change, hackers have started tricking users into authenticating on attacker-controlled computers. This is according to a new report from Microsoft, which says there’s a highly sophisticated campaign currently taking place, with the goal of compromising people’s cloud accounts and stealing as many sensitive files as possible.

The attack starts a lot earlier than what the victim experiences. There is a lot of pre-attack planning and due diligence, in which the threat actors gather as much information about their target as possible. Knowing their place of work, position, and personal phone number is essential.

Once all the pieces are in place, the attack starts with a phone call - victims are told they are speaking to their organization’s IT help desk and that they need to update their passkey (or MFA , depending on the setup) immediately, to avoid any disruptions to their operations.

Follow-up SMS

In the follow-up to the call, the victims then receive an SMS message with a link where they can update their security configuration. On the surface, the website looks like the legitimate Microsoft login landing page. In reality, though, this is a pre-built malicious website that uses the adversary-in-the-middle (AitM) techniques to either receive access on the actor’s behalf, or capture credentials.

"The actor appears to invest heavily in pre-attack research, likely gathering information about employees and organizational structure from public sources such as social networking and professional profiling platforms," Microsoft said. "In a smaller number of cases, actors take advantage of already compromised accounts to expand their reach" by sending similar passkey -themed messages via Microsoft Teams.

The campaign is apparently ongoing since at least May this year, Microsoft, said, without detailing the number of victims. Its aim seems to be to exfiltrate files from SharePoint and OneDrive, as well as email data from Microsoft Exchange Online. It also did not attribute this campaign to any specific threat actor, although it did say that there are many collectives engaged in such, or similar, campaigns, including Cordial Spider, Storm-3121, and others.

Via The Hacker News