A phone call pretending to be the help desk was all it took. In an intrusion investigated by Sophos X-Ops Incident Response, an attacker talked an employee into reading out the SMS code needed to reset their Microsoft 365 password, then used that single account to download roughly 100,000 SharePoint files, export about 2,500 user records from ServiceNow and sign in to Salesforce.
No phishing page, malware or OAuth consent prompt was involved. Sophos researcher Andrew Bonwell's write-up uses the case to show how far a modern identity takeover reaches once the attacker holds a working cloud session.
From a stolen reset code to a trusted device
Several employees at the unnamed organization had reported suspicious calls, and the company sent a warning email to all staff. One user had already been compromised. The caller posed as help desk personnel and obtained the code needed to complete a self-service password reset (SSPR). Within minutes, the attacker registered a new Windows device in Entra ID and used a Primary Refresh Token, a long-lived credential tied to that device, to sign in through Microsoft Edge. That gave a far more durable foothold than a single web login. Later ServiceNow sign-ins were recorded as SAML authentication using the token, with MFA listed as "Previously satisfied", which Sophos says strongly suggests the attacker was riding the existing Microsoft session into each federated app.
Reconnaissance first, then the files
Sophos traced structured Microsoft Graph queries that mapped licences, tenant relationships, directory roles, service principals, domains and SharePoint sites. The attacker then searched SharePoint for terms including password, VPN, SSH, AWS, SSN, NDA and contracts. Four of the recovered queries, some misspelled, named the organization's identity verification vendor, which Sophos says suggests either prior knowledge of the MFA platform in use or a hunt for documentation that could support a bypass.
In Exchange, the attacker accessed over 100 unique mail items and deleted two messages. One of them was the company's own vishing warning, removed so the compromised user would not see it.
The downstream pivots went two different ways. Salesforce's automated anomaly detection fired, froze the account and notified the customer's administrator, and Sophos saw no large-scale CRM extraction. ServiceNow had no such tripwire: the attacker repeatedly viewed and then exported the sys_user table, which can hold names, emails, phone numbers, roles and managers, and also browsed the CMDB computer inventory without exporting it. The organization kept receiving phishing and vishing attempts afterwards, which Sophos says may have drawn on that data. The attacker created no inbox rules, forwarding rules or new applications.
Sophos does not attribute the intrusion. It notes that Mandiant's reporting on GOLD CRYSTAL (ShinyHunters) linked and adjacent extortion activity has described the same shift toward vishing for SSO access and then fanning out into cloud applications.
Lock down account recovery, not only sign-in
Sophos's recommendations start where this intrusion did:
- Prefer phishing-resistant factors such as FIDO2 keys, passkeys or Windows Hello for Business in recovery flows. Where SMS stays in SSPR, exclude administrative accounts and treat resets from unexpected locations as detection signals.
- Require MFA for device registration itself, and alert on any new device registered shortly after a password reset or MFA change.
- Contain by revoking sessions and refresh tokens across the identity provider and every federated SaaS platform, not just by resetting the password.
- Hunt for bulk exports of ServiceNow sys_user and cmdb_ci_computer, SharePoint searches for words like password or the name of your own MFA vendor, and deleted security-awareness emails.
Sophos also flags a quiet blind spot: Microsoft does not audit passive reading of existing Teams chats, so an attacker who opens Teams, as this one did, can read without leaving a record. The mailbox was never the whole prize. For a similar help desk pretext, see our report on Teams callers who tried to seize domain controllers.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.