Archynetys Live news trend intelligence
◼ Archived Technology 🔮 Archynetys predicts: fades by tomorrow — graded ✓ correct

Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks

Fake IT calls and phishing kits are siphoning thousands of Microsoft 365 credentials, slipping past multi‑factor authentication.

By · Published September 10, 2026  10:08 UTC · Updated September 10, 2026  21:41 UTC

9sources
9articles
7velocity
+0%since first seen
45d agofirst detected
Text:
🤖 AI Dossier

Evidence dossier

Intelligence passport

78/100 Excellent
9distinct sources shown
40velocity measurements
1language editions checked
Unsupported statements were removed before publicationbrief evidence status

Measured timeline

📍 Where it landed

The recent wave of fake IT calls targeting Microsoft 365 users appears to have subsided without a definitive conclusion in the coverage. The full extent of the damage and the number of affected organizations remain unclear.

Epilogue added 42d ago, after coverage quieted.

Velocity

How fast coverage is spreading — measured hourly from article rate × source diversity. How this works →

What happened

⚡ Executive Intelligence Takeaways Corroborated across 9 independent newsrooms
  • Velocity & Diffusion: Coverage exploded across 9 distinct news outlets with 9 published articles, achieving a live velocity of 7.
  • Primary Driver: Fake IT calls and phishing kits are siphoning thousands of Microsoft 365 credentials, slipping past multi‑factor authentication.
  • Predictive Outlook: Archynetys algorithmic models forecast this story will fade from trending status over the next 24 hours.
  • Source Integrity: Verified strictly against primary headline reporting under zero-hallucination protocols.

The breach was detected across multiple continents, prompting immediate alerts to affected enterprises and a surge in MFA re‑evaluation. The operation, labeled BigBear 2.0, combines fake IT help‑desk phone calls with phishing emails that deliver the Evilginx2 and ‘Knight Office’ kits. These tools capture session tokens, allowing the threat actors to hijack Microsoft 365 sessions without entering a password, even after MFA is enabled. TechRadar and Computerworld note the use of impersonation scripts that convince executives they are speaking with legitimate support staff, while The Register tracks the credential harvest in real time.

Reporting diverges on the campaign’s impact. The Register and BleepingComputer focus on the raw number of stolen credentials, whereas Security Affairs and thehackernews emphasize extortion attempts against senior staff. CloudSEK provides technical analysis of the Evilginx2 infrastructure, yet few outlets quantify the financial demands or identify the industries most affected, leaving a gap in the broader risk assessment. Moreover, the extent of collaboration between the phishing crew and external call‑center services is not detailed.

Key questions remain unanswered. No source has confirmed whether the kit is being adapted for other cloud services, leaving uncertainty about future attack vectors. Analysts will monitor threat‑intel feeds for signs of the kit resurfacing in other SaaS environments.

Synthesized by Archynetys from the headlines below under a strict no-invention contract. ✓ fact-checked: unsupported claims removed (79% supported) Updated 42d ago.

The reporting (9)

Questions people are asking

What is the name of the phishing campaign targeting Microsoft 365?

The campaign is identified as BigBear 2.0 in multiple reports.

How are attackers able to bypass MFA in this operation?

They use tools such as Evilginx2 and the Knight Office kit to capture session tokens via fake IT help‑desk calls and phishing emails, allowing access without a password.

Which types of organizations are reported to be affected?

Coverage notes compromises at 258 organizations worldwide, with executives in finance, healthcare and technology sectors mentioned as targets.

📊 AUDIENCE & LONGEVITY PULSE

How do you expect this trend to evolve over the next 24 hours?

Cast your vote to register reader intelligence on the velocity and trajectory of this coverage.

Select an assessment to vote. Verified Reader Intelligence

Topics

Microsoft 365 BigBear 2.0 MFA Phishing Fake IT Calls

From around our network

Related trends

Open prediction lab

Can you beat the machine?

Pick tomorrow's top trend, then compare your result with Archynetys's self-graded forecast.

Make a prediction →