Affected Systems

Microsoft cloud environments (Azure AD/Entra ID, Microsoft 365, SharePoint, OneDrive). Campaign 1: U.S. enterprise users in IT services, consumer goods, real estate, and manufacturing (August 2026). Campaign 2: Multiple organizations globally with cloud identities compromised via social engineering (active since May 2026). Threat actors include Storm-3121, Storm-3032/UNC6671, and affiliates linked to Cordial Spider.

Exploitation Status

Active exploitation ongoing. Campaign 1 delivered over 1 million scam emails August 3-5, 2026. Campaign 2 detected since May 2026 with continued activity. Threat actors use adversary-in-the-middle (AitM) and device-code authentication flows. Infrastructure includes registered phishing domains impersonating passkey/SSO services and legitimate brands (ServiceNow). No CVE involved; social engineering and credential harvesting techniques.

Business Impact

Campaign 1 targets finance departments with CEO-impersonated ACH transfer requests, risking direct financial loss. Campaign 2 compromises cloud identities via passkey-themed phishing, leading to unauthorized authentication method additions, high-volume Microsoft Graph API abuse, SharePoint/OneDrive data exfiltration, and mailbox collection via REST APIs. Attackers leverage AI-generated email templates and conduct pre-attack reconnaissance via LinkedIn and social media. Compromised accounts used for lateral movement via Microsoft Teams. Risk of data breach, financial fraud, and potential ransomware/extortion (linked to ShinyHunters, Falcon, BlackFile groups).

Urgency

🟠 Within 24 hours

Recommended Actions

  • Enable conditional access policies in Azure AD/Entra ID requiring phishing-resistant MFA (FIDO2, certificate-based) for all cloud sign-ins, especially privileged accounts.
  • Block or flag emails from newly registered domains (< 30 days) and domains mimicking internal naming patterns (e.g., ..com). Monitor for domains containing 'passkey', 'sso', 'okta', 'portal' keywords.
  • Audit Microsoft 365 sign-in logs for suspicious authentication method additions, high-volume Microsoft Graph API calls, and bulk SharePoint/OneDrive downloads. Alert on REST API mailbox access from unfamiliar IPs or proxy infrastructure.
  • Train finance and IT staff to verify payment requests via out-of-band communication (phone call to known number, not reply email). Establish ACH transfer approval workflows requiring multi-person authorization.
  • Review and restrict Microsoft Teams external access settings to prevent unsolicited messages from compromised accounts. Disable device-code authentication flow if not required (Azure AD > Authentication methods).