Microsoft has laid out a pair of campaigns that share an unsettling theme: attackers are borrowing the language of security itself to get past it.
The first campaign sent more than a million scam emails over just three days in early August, each one posing as a company CEO asking accounts payable to wire money for a fake ServiceNow subscription. Researchers say the attackers likely used generative AI to draft the emails, and they did not run the usual clumsy phishing playbook. The messages carried forged invoices, fabricated email threads, and real executive names the attackers pulled from public sources, and they wove all of it together so the request looked routine rather than suspicious. The group even registered domains like service-nowinc[.]com just to sell the illusion.
The second campaign gets more interesting, and more troubling for anyone managing cloud infrastructure. Instead of stealing passwords outright, attackers have been calling or texting employees on their personal phones, claiming to be IT help desk staff, and telling them their passkey or MFA setup needs an urgent update.
The link leads to a fake Microsoft sign-in page. From there, the attacker either grabs the credentials directly or talks the employee through a device-code flow that hands over account access without ever touching a password.
Once inside, the pattern looks less like a smash and grab and more like a patient occupation. Microsoft says attackers typically register their own MFA method first, often a new phone number or authenticator app, so they can keep signing in even after someone notices the original compromise. From there they run reconnaissance through the Graph API, harvest mailboxes, and pull bulk downloads from SharePoint and OneDrive that can stretch on for days.
Microsoft has tied parts of this activity to groups it calls Storm-3121 and Storm-3032, and Mandiant has traced overlaps to a loosely connected set of extortion brands that share phishing infrastructure. The detail worth sitting with is simpler than any group name: attackers have turned the feature meant to make cloud accounts harder to break into into the pretext they use to break into them.
