In a recent security disclosure, Microsoft’s threat intelligence teams have exposed a dual-pronged offensive by malicious actors who are increasingly leveraging generative artificial intelligence and highly personalized social engineering to compromise enterprise environments. These campaigns, which have been active throughout the summer and into September 2026, demonstrate a significant evolution in how threat actors bypass traditional security barriers, including multi-factor authentication (MFA) and corporate procurement workflows. By abusing third-party email delivery infrastructure and weaponizing the transition to passkey-based authentication, these groups have successfully targeted diverse sectors, ranging from IT services to manufacturing.
The Financial Fraud Campaign: AI-Driven Invoice Deception
The first campaign identified by Microsoft represents a high-volume effort to subvert accounts payable departments through sophisticated executive impersonation. Between August 3 and August 5, 2026, researchers observed a surge of over one million scam emails. Unlike rudimentary phishing attempts, these communications were crafted with the assistance of generative AI to ensure linguistic accuracy and tone, mirroring the communication style of corporate leadership.
The objective of this operation was the extraction of funds via Automated Clearing House (ACH) transfers. Threat actors masqueraded as high-ranking executives—typically CEOs or CFOs—to pressure finance teams into processing fraudulent invoices for supposed ServiceNow annual subscriptions. This "unified narrative" approach allowed attackers to bypass the skepticism usually triggered by solitary phishing lures. By layering executive impersonation with professional-grade vendor branding and fabricated email threads that appeared to show internal approval, the attackers created a false sense of urgency and legitimacy.
The logistical precision of this campaign involved several distinct phases. First, attackers registered look-alike domains to establish a credible digital footprint. Second, they utilized legitimate, high-reputation third-party email infrastructure to deliver these messages, effectively evading standard spam filters that often flag emails originating from suspicious or unknown mail servers. Finally, by populating email signatures with the actual names and credentials of real company leadership, they exploited the internal trust hierarchies within the targeted firms. This campaign primarily targeted U.S.-based enterprises, with a notable focus on sectors such as consumer goods, real estate, and discrete manufacturing, where procurement processes may involve recurring software subscription payments.
Cloud Compromise via Passkey-Themed Social Engineering
While the first campaign sought direct financial gain, the second, more insidious campaign—detected as early as May 2026—focused on long-term persistence and data exfiltration within cloud environments. This operation marks a tactical shift toward exploiting the "identity perimeter." As organizations move away from traditional passwords in favor of passkeys and modern MFA protocols, threat actors are weaponizing this transition.
The attack typically begins with a voice-phishing (vishing) call to an employee’s personal phone. The attacker, posing as a member of the organization’s internal IT help desk, creates a sense of urgency, insisting that the employee must immediately "update their passkey" or "synchronize their single sign-on (SSO) configuration" to prevent a lockout. This social engineering is often backed by SMS messages containing links to counterfeit portals that perfectly replicate the Microsoft login experience.
Once the user arrives at these malicious sites, the attackers employ Adversary-in-the-Middle (AitM) techniques or device-code authentication flows. These methods allow the attackers to capture session tokens or force the user to unknowingly grant the attacker access to their account. Once inside, the threat actors immediately move to establish persistence. This involves adding their own secondary authentication methods—such as a new phone number, an unauthorized authenticator app, or a software-based one-time password (OTP) token—effectively locking out the legitimate user while ensuring the attacker retains a "backdoor" to the corporate account.
Infrastructure and Attribution: The UNC6671 Connection
Microsoft’s analysis suggests a link between these cloud-based intrusions and a collective of threat actors known in the security industry by several aliases, including UNC6671, Cordial Spider, and O-UNC-045. This loose-knit syndicate is known for operating various extortion brands, often sharing infrastructure and "playbooks" for initial access.
The connection to these groups is supported by the observed use of common credential-harvesting panels and a distinct pattern in domain registration. Attackers have been observed creating domains that include the target organization’s name as a subdomain—for instance, [company-name].[malicious-domain].com. This granular level of targeting, combined with pre-attack research into corporate structures using public platforms like LinkedIn, underscores the professionalization of these cybercrime rings.
Microsoft has specifically attributed the activity to groups like Storm-3121 and Storm-3032. The former is linked to high-profile extortion groups such as ShinyHunters, while the latter (Storm-3032) represents the operational arm of the UNC6671 collective, which has recently rebranded its extortion efforts under the "Helix" moniker. This indicates that while the actors may work independently or in splintered cells, they draw from a shared ecosystem of specialized tools, phishing templates, and professional "call center" support for their vishing campaigns.
Strategic Implications and Detection Challenges
The implications of these campaigns are profound for modern enterprise security. The shift toward AI-generated phishing content means that traditional markers of malicious activity—such as poor grammar or inconsistent branding—are rapidly disappearing. Furthermore, the abuse of the Microsoft Graph API highlights a critical detection gap. Because individual API calls within a compromised cloud environment may appear benign when viewed in isolation, security operations centers (SOCs) often struggle to identify the malicious intent behind a series of legitimate-looking queries.
Microsoft’s security team has emphasized that defense must now move toward "holistic assessment." Instead of relying on alerts for single events, organizations must correlate user behavior across multiple platforms. If a user’s sign-in is followed by a registration of a new MFA device, and that device is immediately used to perform high-volume Graph API requests—such as downloading files from SharePoint or accessing mailboxes via REST APIs—the system should trigger an automated block, regardless of the apparent legitimacy of the individual actions.
Chronology of Escalation
- May 2026: Initial detections of passkey-themed vishing campaigns targeting Microsoft cloud identities begin to appear.
- August 3–5, 2026: A massive, coordinated wave of AI-assisted invoice fraud hits U.S. enterprises, involving over one million emails.
- Late August 2026: Security researchers identify a clear overlap between the vishing actors and known extortion collectives, specifically noting the role of UNC6671.
- September 9–10, 2026: Microsoft officially publishes threat intelligence reports detailing the two campaigns, providing technical indicators and mitigation strategies for organizations.
Recommendations for Mitigation
To defend against these threats, cybersecurity experts suggest a multi-layered approach. First, organizations should implement strict conditional access policies that restrict the ability to register new MFA methods from unmanaged devices or unusual locations. Second, internal training must be updated to address the reality that "IT help desk" calls can be intercepted or spoofed; employees should be instructed to verify the identity of help desk callers through secondary, internal channels before providing any authentication codes or clicking links.
Finally, the use of hardware-based security keys (FIDO2) remains the most robust defense against AitM-based phishing. Unlike software-based OTPs, hardware keys are inherently resistant to interception, as they require a physical presence and verify the origin of the login request, preventing the attacker from acting as a "middleman."
As these threat actors continue to refine their methods, the divide between "social engineering" and "technical exploitation" continues to blur. The 2026 campaigns serve as a stark reminder that the most sophisticated technical safeguards can be rendered obsolete if the human element—the user—is manipulated into opening the gate. Organizations must, therefore, balance their investment in defensive AI with a renewed focus on identity verification, session monitoring, and a culture of skepticism toward urgent requests for credentials, regardless of the source.
