Voice Callers Exploit BYOD to Reach Microsoft 365, Corporate Data
Threat actors are leveraging Microsoft's Graph API and social engineering tactics to bypass corporate security measures and steal sensitive data. By impersonating IT helpdesks and exploiting employees’ personal devices, they trick users into updating authentication methods, granting them access to corporate accounts. These attackers, including Storm 3032 and Storm-3121, then use the Graph API to map out corporate environments and exfiltrate data from services like SharePoint and OneDrive. Microsoft recommends enhanced logging, stricter Graph API permissions, and bolstering authentication controls to mitigate these attacks.
Threat actors are exploiting Microsoft's Graph API and sophisticated social engineering to gain unauthorized access to corporate data and systems. These attackers are bypassing traditional security measures by targeting employees’ personal devices, a common practice in many organizations. They are impersonating IT helpdesks via phone calls or text messages, convincing users to update authentication methods – such as passkeys, multi-factor authentication (MFA), or single sign-on (SSO) configurations – to avoid losing access to their work accounts.
If an employee doesn’t recognize a suspicious communication as coming from their employer’s IT helpdesk, they’ll likely follow a link sent to their phone, leading them to a convincing Microsoft sign-in page. At this point, attackers utilize adversary-in-the-middle (AiTM) techniques to steal credentials and session tokens, and device code phishing flows.
More significantly, these attackers are avoiding using malware or other suspicious tools within corporate networks, instead leveraging the Microsoft Graph API – a shared gateway for all Microsoft cloud services. The Graph API allows authorized users to inventory users, resources, content, permissions, and other information useful for an attacker wanting a full understanding of their environment. Requests to endpoints such as /users, /groups, or /sites are commonplace in enterprise environments, making suspicious activity difficult to detect at first glance.
Threat actors are then using this reconnaissance to exfiltrate sensitive data from services like SharePoint, OneDrive, and Exchange, often downloading small batches of files over extended periods to avoid detection. The attackers, including Storm 3032 and Storm-3121, are successfully bypassing corporate security measures by targeting employees’ personal devices and leveraging social engineering.
Microsoft recommends organizations actively log and hunt for suspicious application data exfiltration events and batch Graph API calls, and tightly restrict users’ Graph permissions in general. Additionally, they advise implementing stricter authentication and authorization measures, such as requiring phishing-resistant MFA for every sign-in, blocking device code authentication flows where unnecessary, and limiting application access to managed devices. Robert Coles, senior manager of threat intelligence security at Black Duck, emphasizes that focusing on strengthening identity and authentication controls is more effective than attempting to eliminate bring your own device (BYOD) entirely, as attackers are convincing users to trust them, not compromising devices directly.