Phone Call Scam Turns One Stolen Microsoft 365 Account Into a Wider Cloud Breach

Business email compromise is often seen as a problem limited to a mailbox. A recent Sophos X-Ops Incident Response case shows how much further an attacker can go once they control a cloud identity. The threat actor used voice phishing (a scam phone call) and abuse of self-service password reset to take over a Microsoft 365 account, set up a device session backed by a Primary Refresh Token, and move into several other cloud platforms.

The attack began when staff received suspicious calls. The company emailed a warning to all employees, but one user had already been compromised. That user said the caller pretended to be help desk staff and convinced them to hand over the SMS verification code needed to finish a password reset. Sophos also noted an earlier reset attempt from an unusual location the day before. It is unclear whether that was related, but it may have been probing.

From that single account, the attacker carried out Microsoft Graph reconnaissance, accessed email and SharePoint, and downloaded nearly 100,000 documents. They also accessed Salesforce and exported a user table of about 2,500 records from ServiceNow. The case shows that one tricked employee can expose a business's whole cloud environment, not just their inbox.