Hackers Pose as IT Support to Hijack Microsoft 365 Accounts With Fake Passkey Alerts

Gbhackers •Mayura Kathir • September 10, 2026

Threat actors are impersonating corporate IT helpdesk staff in an active social-engineering campaign that hijacks Microsoft 365 identities, establishes MFA persistence, and systematically collects data from SharePoint, OneDrive, and Exchange Online. Microsoft Security Research said it has observed the cloud-focused intrusions since May 2026. The activity is marked by unusual sign-ins, attacker-added authentication methods, extensive […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Spring Ring: Coordinated Vishing Campaign Exploits Microsoft Teams Between January and April 2026, a coordinated voice phishing campaign named Spring Ring targeted over 150 employees across more than 10 companies using fake IT support accounts on Microsoft Teams. Attackers registered external Teams tenants with names resembling internal IT departments to gain trust. The campaign involved two distinct attack vectors: one directed victims to launch remote support software, while the other sent malicious links disguised as legitimate files. Both methods aimed to install malware or gain remote access to victims' systems. Unit 42 of Palo Alto Networks documented the attacks and reported that phishing alerts from collaboration platforms surged to 42% of all alerts in early 2026. The campaign was characterized by its use of social engineering tactics, exploiting the trust users place in collaboration tools. The attacks were blocked before achieving their objectives, highlighting the need for enhanced security awareness training. 52 sources 68

Hackers Pose as IT Support to Hijack Microsoft 365 Accounts With Fake Passkey Alerts

The full story

Extracted Entities

Platforms (3)

Tools (1)