Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks

Threat hunters have disclosed details of a widespread data theft and extortion threat cluster that’s targeting Microsoft 365 and other software-as-a-service (SaaS) offerings through information technology (IT) help desk vishing, adversary-in-the-middle (AitM) token theft, and residential-proxy sign-ins.The activity, which mainly singles out directors, vice presidents, and other executive staff

First seen on thehackernews.com

Jump to article: thehackernews.com/2026/09/microsoft-365-attackers-use-help-desk.html