Attackers call employees’ personal phones to break into Microsoft 365 accounts

Attackers are calling or texting employees on their personal phones, posing as internal IT staff, in a social engineering campaign that tricks them into handing over access to corporate cloud accounts. Once inside, they pull files and email from Microsoft 365 apps, SharePoint, OneDrive, and inboxes, for weeks at a time…

Short extract only — this publisher licenses its text. Read the full release at the source.