Microsoft reports two complex campaigns compromising cloud accounts

Microsoft has detailed two recent campaigns in which attackers used fraudulent emails and passkey-themed social engineering to gain access to cloud accounts and exfiltrate files. The attacks, primarily targeting US enterprises, involved fake emails impersonating top executives and calls posing as IT staff to deceive finance teams and other employees. Microsoft confirms both credential theft and significant data exfiltration from services including SharePoint and OneDrive.

• Attackers impersonated executives in scam emails
• Generative AI used to craft fraudulent messages
• Victims prompted to update passkeys via fake IT calls
• Cloud files exfiltrated from SharePoint and OneDrive
• Campaigns mainly targeted US enterprise sectors