Beware of new MS365 voice phishermen

1 day ago
2 min read

Microsoft released a new feature in May that allows you to secure your Microsoft 365 account using passkeys, a new, safer and simpler way of authenticating instead of using a traditional username, password and 2 factor code.... at least that's the idea.

But of course, the bad actors are taking advantage. A new campaign from the Pink Extortion Gang is targeting companies in the food and beverage, technology, healthcare, automotive, construction, and aviation industries. They simply call employees pretending to be the IT department, convince them to go to a fake company login page, authenticate and then hijack your passkey for themselves.

What comes next is no fun. They download all of your emails, OneDrive and files you have access to in SharePoint. If they find anything valuable, like copies of passports, driver's licenses social security numbers or confidential company or customer data, they'll contact you to pay a ransom or threaten to sell it on the dark web. Unfortunately once the toothpaste is out of the tube, it's nearly impossible to put back in.

The Takeaway

So how can you keep this from happening at your company?

Require a ticket before IT support begins.
You and your employees should not accept unexpected IT calls, Teams messages, or remote support requests unless there is an open ticket they recognize. No ticket, no access.
Use a secret passphrase.
Give employees and IT staff a simple verbal passphrase, such as “Spaghetti.” If someone claiming to be IT does not know it, stop the conversation and report it.
Never share passwords, MFA codes, or remote access.
Real IT should not ask for your password or unexpected MFA approval. When in doubt, slow down, verify, and report suspicious requests.