Affected Systems

Microsoft 365 / Entra ID users across multiple organizations. Campaign active since May 2024 (likely typo in source stating "May 2026"). Targets include SharePoint, OneDrive, Exchange, and Microsoft Graph API access. All organizations using Microsoft cloud services with MFA are potential targets.

Exploitation Status

Active exploitation confirmed since May 2024. Threat actors use adversary-in-the-middle (AiTM) phishing and device code authentication flows. Infrastructure includes domains registered via Nicenic registrar, operational within hours. Actors leverage phone-based social engineering, SMS phishing, and compromised Microsoft Teams accounts for lateral spread.

Business Impact

Attackers gain persistent access to cloud environments by adding unauthorized MFA methods, enabling long-term reconnaissance and data exfiltration. High-volume Microsoft Graph API queries reveal organizational structure. Attackers access SharePoint, OneDrive files, and email via REST APIs. Compromised identities may be used to target additional employees via trusted internal Teams messages. Minimal forensic evidence if phishing occurs on personal, unmanaged mobile devices. Incident response requires correlation across identity logs, Graph API telemetry, and user reports of suspicious calls/SMS.

Urgency

🔴 Immediate

Recommended Actions

  • Audit all Entra ID (Azure AD) user accounts for recently added authentication methods (FIDO2, phone, authenticator apps) and revoke unauthorized entries via Azure Portal or Microsoft Graph API
  • Review sign-in logs for anomalous device code authentication flows, unmanaged device access, and high-volume Microsoft Graph API calls following authentication events
  • Block known malicious domains (secure-passkey[.]com, integratedsso[.]com, add-passkey[.]com, oktasession[.]com, keysyncos[.]com, validationsetupac[.]com, portalsetuphub[.]com) at DNS/proxy layer and monitor for subdomain pattern companyname[.]maliciousdomain[.]com
  • Enforce Conditional Access policies requiring compliant/managed devices for Microsoft 365 access and restrict Microsoft Graph API permissions to least-privilege
  • Conduct user awareness training on passkey/SSO phishing lures, emphasizing verification of IT helpdesk requests via official channels and reporting unsolicited calls/SMS to security teams