Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks

Recent coverage from outlets including The Hacker News, The Register, TechRadar, Computerworld, Security Affairs, Windows Report, IT Security Guru, BleepingComputer, and CloudSEK details significant cybersecurity threats targeting Microsoft 365 users across the world. Specifically, fake IT help desk calls and phishing emails are being utilized to target executives and other users in data theft and extortion attacks. Reports highlight that the BigBear phishing crew, along with a campaign designated as BigBear 2.0 utilizing Evilginx2, has netted thousands of Microsoft 365 credentials. According to the reporting by BleepingComputer, the BigBear Microsoft 365 phishing service successfully bypassed multi-factor authentication at two hundred fifty-eight organizations.

Windows Report specifies that the campaign has stolen five thousand credentials, while IT Security Guru notes the deployment of a new 'Knight Office' phishing kit that steals logins without touching a password. Additional mechanics highlighted in the coverage involve session hijacking that occurs after multi-factor authentication has already been completed by the targeted users. This trend emerges as a major multi-pronged threat landscape involving two distinct campaigns hitting Microsoft 365 users globally. The utilization of fake IT help desk impersonation represents a significant evolution in social engineering tactics, allowing malicious actors to trick individuals into granting access.

Security researchers and tracking organizations such as CloudSEK have been closely monitoring these operations, documenting how the infrastructure facilitates widespread credential harvesting and unauthorized session access across diverse corporate networks. As coverage continues to develop, observers and security professionals are tracking the operational methods of the BigBear crew and the deployment of tools like the Knight Office phishing kit. Future reporting will likely follow further disclosures regarding the extent of organizational compromises, additional technical details about the Evilginx2 framework utilization, and potential mitigations deployed to counter IT help desk impersonation attacks and session hijacking vectors.