INITIAL access brokers are phishing employees by calling or texting their personal devices, then exploiting the Microsoft Graph API to perform large-scale corporate data exfiltration. The piece notes that BYOD is common in many organisations, and attackers have started by targeting staff on their own phones with pretexts that mimic IT helpdesk communications.
Employees are induced to log into a Microsoft sign-in page via a link or to complete a device-code authentication flow, enabling threat actors to harvest credentials and session tokens. Microsoft has observed two threat actors, Storm 3032 and Storm-3121, using this approach to bypass authentication protections, and these actors are likely passing their gained access to extortion groups such as ShinyHunters, though Microsoft has not tied any specific breaches to these campaigns.
Threat actors characterise their activity by low‑profile exfiltration, often downloading small batches of data from SharePoint, OneDrive and Exchange over extended periods rather than large, obvious transfers.
The practical route hinges on abusing Microsoft Graph as a reconnaissance and data‑collection tool. Graph API calls allow attackers to inventory users, resources and permissions, facilitating a full map of an organisation’s data landscape without triggering traditional malware alerts. Microsoft advises organisations to monitor for suspicious application data exfiltration events and anomalous batch Graph API calls, and to tighten Graph permissions.
To address personal-device risk, the guidance includes phishing‑resistant MFA for all sign‑ins, blocking unnecessary device-code authentication flows, and limiting application access to managed devices. Security professionals, including Robert Coles of Black Duck, emphasise strengthening identity and authentication controls over outright BYOD bans, noting that the attackers convinced the user rather than compromising the device, so containment should focus on limiting damage from compromised identities.