Full Report
Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using passkey-themed social engineering to breach cloud environments. The first campaign, per the tech giant, involved sending over a million scam emails between August 3 and 5, 2026, by masquerading as chief executive officers
Analysis Summary
# Incident Report: Dual Campaigns Involving AI-Assisted Financial Fraud and Passkey Social Engineering
## Executive Summary
Microsoft has disclosed two distinct cyber campaigns targeting enterprise cloud environments. The first uses generative AI to execute high-volume financial fraud through CEO impersonation, while the second employs sophisticated social engineering (passkey-themed) to bypass MFA and hijack Microsoft Cloud accounts for data exfiltration. Both campaigns leverage trusted infrastructure and pre-attack reconnaissance to increase success rates.
## Incident Details
- **Discovery Date:** September 2026 (Public Disclosure)
- **Incident Date:** May 2026 – August 2026
- **Affected Organization:** Multiple enterprise targets (Unnamed)
- **Sector:** IT services, consumer goods, real estate, and discrete manufacturing
- **Geography:** Primarily United States
## Timeline of Events
### Initial Access
- **Campaign 1 (Aug 3–5, 2026):** Over one million scam emails were sent masquerading as CEOs. The vector was third-party email delivery infrastructure using impersonation domains.
- **Campaign 2 (May 2026 – Ongoing):** Attackers initiated contact via personal phone calls/SMS or compromised Microsoft Teams accounts, posing as IT help desk staff.
### Lateral Movement
- **Identity Hijacking:** Attackers used Adversary-in-the-Middle (AitM) and device-code authentication flows to gain control of legitimate cloud identities.
- **Internal Spread:** In several cases, compromised accounts were used to target other employees via Microsoft Teams to expand the breach.
### Data Exfiltration/Impact
- **Financial Fraud:** Attempted to divert funds via ACH transfers for fake ServiceNow subscriptions.
- **Cloud Data Theft:** High-volume Microsoft Graph activity, including bulk downloads from SharePoint and OneDrive and mailbox collection via REST APIs.
### Detection & Response
- **Detection:** Microsoft detected suspicious sign-in patterns followed by the addition of unauthorized authentication methods and anomalous Graph API activity.
- **Response:** Microsoft Security Research team analyzed the infrastructure and issued public guidance/IOCs to help organizations defend against these specific themes.
## Attack Methodology
- **Initial Access:** Email spoofing, SMS phishing (Smishing), and Vishing (Voice Phishing).
- **Persistence:** Threat actors added their own authentication methods (MFA/Passkeys) to compromised accounts.
- **Defense Evasion:** Use of trusted third-party email infrastructure; registration of look-alike domains; AI-generated, highly polished email content.
- **Credential Access:** AitM phishing pages and abuse of Microsoft device-code authentication flows.
- **Discovery:** Extensive pre-attack reconnaissance using social networking and professional profiling platforms.
- **Collection:** Automated collection using REST APIs and Graph activity.
- **Exfiltration:** Systematic downloading of SharePoint and OneDrive files.
- **Impact:** Financial loss through fraudulent ACH transfers and unauthorized access to proprietary data.
## Impact Assessment
- **Financial:** High potential impact; millions of emails targeted accounts payable for fraudulent annual subscription fees.
- **Data Breach:** Compromise of corporate mailboxes, OneDrive files, and SharePoint repositories.
- **Operational:** Disruption to identity management systems and finance workflows.
- **Reputational:** Abuse of executive identities to deceive employees and vendors.
## Indicators of Compromise
- **Network/Domain Indicators:**
- service-nowinc[.]com
- domainlify[.]net
- **Behavioral Indicators:**
- Unexpected requests to update passkeys/MFA via SMS or personal phone calls.
- Addition of new MFA methods immediately following a sign-in from a proxy-associated IP.
- Spikes in Microsoft Graph API activity or REST API mailbox access.
## Response Actions
- **Containment:** Revocation of compromised sessions and removal of unauthorized authentication methods.
- **Eradication:** Blocking of known impersonation domains at the email gateway.
- **Recovery:** Restoration of secure access through verified identity verification processes.
## Lessons Learned
- **AI-Enhanced Phishing:** Threat actors are now using Generative AI to remove common red flags (like poor grammar) and create convincing "supporting" email threads.
- **MFA Vulnerability:** Even modern authentication methods like passkeys are being used as a social engineering "lure" to trick users into AitM or device-code attacks.
- **Reconnaissance:** Attackers are heavily investing in researching organizational structures before initiating contact.
## Recommendations
- **User Training:** Educate employees that IT help desks will rarely, if ever, ask for a passkey update via a personal SMS or call.
- **Technical Controls:** Implement Conditional Access policies to restrict device-code flow and enforce compliant/managed device requirements.
- **Monitoring:** Enable alerts for anomalous Graph API activity and the registration of new MFA methods by existing users.