Hackers Let Victims Complete MFA Then Steal the Entire Microsoft 365 Session
A new scam tricks people into completing a real Microsoft sign-in request, then takes control of their Microsoft 365 account session even if extra sign-in protection is enabled. This means attackers may get into email, files, and other work accounts without needing to know the person’s password.
Who is at risk
Anyone who uses Microsoft 365, especially employees, contractors, schools, and small businesses that rely on Microsoft email and cloud services, is most at risk.
What to watch for
Watch for unexpected Microsoft sign-in prompts, requests to enter a code on another device, or messages urging you to approve account access you did not start yourself.
What to do
Do not approve unexpected sign-in requests or enter sign-in codes from unsolicited messages, and immediately report any suspicious Microsoft login prompt to your IT team or service provider.