Voice‑Call Phishing Campaign Hijacks Microsoft 365 via BYOD Exploit, Fuels Extortion Trade

Security researchers have uncovered a new attack chain that starts with a voice‑call phishing attempt, leverages bring‑your‑own‑device (BYOD) configurations, and ultimately grants criminals access to Microsoft 365 environments, where the data is handed off to extortion groups such as ShinyHunters.

The operation begins when a caller pretends to be an IT support representative, convincing employees to install a malicious application on personal devices used for work. Because many organizations allow BYOD access to corporate resources, the malicious app can tap into the device’s authentication tokens and establish a foothold in the victim’s Microsoft 365 tenant.

Once inside, the threat actors exploit Microsoft’s Graph API – a unified endpoint that administrators use to manage users, groups, and files across the Office suite. By issuing carefully crafted Graph queries, the attackers enumerate high‑value accounts, locate privileged groups, and harvest authentication credentials without triggering typical security alerts.

Collected credentials are then packaged and sold or transferred to ransomware‑extortion outfits, most notably the notorious ShinyHunters collective. The extortion groups threaten to expose or encrypt the stolen corporate data unless a ransom is paid, turning what began as a phone‑based social engineering ploy into a full‑scale data‑leak operation.

Microsoft has issued guidance urging administrators to tighten Graph API permissions, enforce conditional access policies for BYOD devices, and monitor for anomalous token usage. Industry analysts also recommend multi‑factor authentication for all privileged accounts and regular audits of third‑party applications that request Graph API scopes.

Experts say the technique underscores the growing convergence of social engineering, cloud‑native APIs, and ransomware economics. As organizations continue to embrace flexible work models, the attack surface expands, making it essential for security teams to adopt a holistic approach that blends user education, strict device management, and continuous API activity monitoring.