Microsoft describes two fraud campaigns: fake invoices and access to Microsoft 365 via passwords

Microsoft has published technical analyses on two recent campaigns that combine advanced social engineering and legitimate infrastructure abuse to disappoint companies and take control of cloud accounts. According to the company, the confirmed facts include a massive wave of fraudulent e-mails that sought bank transfers by ACH and a persistent campaign of access to corporate identities by means of baits related to passkeys and authentication flows. Then I explain what happened, how technical tactics work, who are exposed, what real consequences can be derived and what concrete steps should be taken by companies and employees.

Verified facts: Microsoft reported that between 3 and 5 August 2026, more than a million fraud posts were sent to accounts payable departments, using senior executive supplanting (CEO / CFO) and claiming invoices for an alleged annual subscription to ServiceNow. The company also documented activity since May 2026 consisting of intrusions to Microsoft 365 environments where actors recorded their own authentication methods, carried out mass downloads via Microsoft Graph and extracted mail and files from SharePoint / OneDrive.

How the invoice scam works technically (campaign 1): operators record domains that seem legitimate, build fake mail threads that include invoices and signatures of real executives and send messages through reliable third party mail delivery services to avoid filters. Microsoft indicates that the messages were designed to reduce suspicion: a combination of management supplanting, supplier marks and simulated previous conversations. In addition, there is evidence (according to Microsoft) of the use of generic IA tools to produce large-scale custom templates and texts.

How the Passkey and Cloud Access Campaign (Campaign 2) works technically The first phase is prior research: collection of public information on employees and organizational structure. Then comes direct social engineering by phone or SMS directed to the employee's personal number, making him believe that it comes from help desk to update a passkey or SSO configuration. The victims are redirected to false sites that mimic Microsoft's login experience; through AitM (adversary-in-the-middle) or vice-code phishing flows the actor gets the user to authorize access or complete a flow that allows the attacker to log in without stealing the password directly. After initial access, the actor records MFA methods under its control (phone number, authentication app or software token) to convert temporary access into persistent and use Microsoft Graphh API to invent, download and exfilter high-speed data, rotating IP infrastructure and addresses to evade detections.

Those affected: medium and large enterprises with a presence in the United States. The US was the target of invoice fraud, especially sectors such as IT services, consumer goods, real estate and discrete manufacturing. In the cloud access campaign, victims are often users with business or technical roles with access to resources in Microsoft 365; the technique is attractive to actors looking for accounts with rights for SharePoint, OneDrive or sensitive information mailboxes.

Actual consequences In the first case, the risk is direct financial: fraudulent authorization of ACH transfers and loss of funds. In the second, the threat is data exfiltration, corporate espionage and extortion preparation (double impact: stolen data and possible blackmail). In addition, persistence through MFA-controlled methods makes recovery difficult and can allow lateral movement within the tenant.

Still uncertain or estimated aspects: while Microsoft attributes some activities to tracked actors such as Storm-3121 and UNS6671 and notes overlap with community-detected collectives, the exact relationship between shared groups, affiliates and phishing panels is not fully publicly confirmed. Nor is there a consolidated public number of accounts committed in the Graphh campaign; Microsoft describes patterns and cases, but the total scope of the commitment in organizations outside the incidents investigated by the company remains estimated.

Specific technical and organizational measures (what companies should do): implement strict payment controls: require out-of-band verification (call to known number) for beneficiary changes or payment approvals, require double signature in ACH transfers and retain funds until verification. Apply strengthened authentication policies: block the registration of new MFA methods without administrative approval, limit default phone- as- MFA registration and prioritize hardware-proof factors (FIDO2 / Passkeys with attestation). Configure conditional access policies to restrict where and how MFA can be authorized and disable automatic registration methods for privileged accounts. Monitor and correlate Microsoft Graph activity: active alerts by mass discovery patterns, sustained downloads or accesses from proxy infrastructures and treat Graphh calls in an aggregate way (behavior, not just individual calls). Use domain lock / monitoring lists that mimic suppliers and configure phishing prevention rules on the mail gateway and on Defender for Office 365. Revocate sessions and force reauthentication after detection of changes in authentication methods and perform rotation of privileged credentials after incidents.

Specific recommendations for employees and finance departments: never authorize transfers by mail only; if an invoice or an urgent order arrives, confirm through the known channel (verified corporate phone). Do not follow links received by SMS or urgent signals by announcing "update your passkey" without checking the IT area. If you receive a help desk call that asks for MFA change, hang up and call the official internal number. Focused training in vishing and checking of digital signatures and mail headers can reduce risks.

Useful resources and additional reading: Microsoft publishes analysis and mitigation on its security blog ( Microsoft Security Blog), and public agencies offer practical guides on Business Email Commitments and strategies for defence against phishing and identity abuse (see, for example, the CISA guide on BEC https: / / www.cisa.gov / resources-tools / business-email-compromise). To understand risks and good practices on passkeys, the UK National Cybersecurity Centre provides a useful introduction: https: / / www.ncsc.gov.uk / guidance / passkeys-beginners-guide.

In short, these incidents show two convergent trends: the use of legitimate infrastructure and scale delivery capacity to evade mail controls, and the sophistication of social engineering aimed at breaking modern authentication mechanisms. To reduce the probability and impact of these campaigns, a mix of technical controls (blockages on MFA registration, Graph monitoring, strict payment policies) and human processes (off-band verification and targeted training in viewing and targeted phishing) is required.