Threat actors are compromising corporate Microsoft 365 environments by impersonating IT help desks via phone or SMS to trick employees into bypassing multi-factor authentication. These campaigns utilize adversary-in-the-middle phishing portals to hijack accounts and exfiltrate sensitive data. Financial institutions must remain vigilant against these social engineering tactics targeting cloud identity infrastructure.
Relevant URL: https://thehackernews.com/2026/09/attackers-use-passkey-phishing-to.html
