Coordinated Vishing Attacks Targeting SaaS Executives

A coordinated campaign is targeting executives in SaaS companies, primarily using Microsoft 365, through social engineering techniques. Attackers initiate contact via phone calls posing as internal IT support, leading victims to phishing sites that capture session tokens rather than passwords. This method allows attackers to bypass multi-factor authentication (MFA) and access sensitive corporate data. The campaign has been observed to use residential proxies to mask the attacker's location, making detection difficult. The primary targets are high-ranking officials such as directors and vice presidents, who have access to strategic information. The attacks have been ongoing since at least May 2026, with a focus on organizations reliant on Microsoft 365. The threat landscape is particularly concerning in Latin America due to the widespread use of these platforms. Microsoft Security Research is actively tracking these incidents.

Key Points: • Executives in SaaS companies are primary targets of a coordinated vishing campaign. • Attackers use phone calls to impersonate IT support and capture session tokens. • The campaign has been active since May 2026, focusing on organizations using Microsoft 365.