Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks

Recent reports across the technology sector highlight a wave of sophisticated cyber attacks targeting corporate leadership. According to coverage from outlets including The Hacker News, fake IT support calls are actively targeting executives in an effort to execute Microsoft 365 data theft and extortion operations. Meanwhile, IT Security Guru documented the emergence of a new phishing kit known as Knight Office, which captures credentials without requiring traditional password inputs. Furthermore, research published by CloudSEK outlines ongoing technical tracking efforts focused on the BigBear 2.0 campaign, which utilizes Evilginx2 infrastructure to compromise enterprise defenses. Media coverage places heavy emphasis on the operational methods used by these threat actors to bypass standard security protocols.

Outlets such as BleepingComputer, The Hacker News, CloudSEK, and IT Security Guru have all published distinct analyses focusing on the mechanics of these campaigns. The reports detail how attackers combine human-targeted social engineering via telephone calls with automated infrastructure like Evilginx2 and specialized kits. Coverage does not yet specify the full list of impacted entities beyond the organization count provided by BleepingComputer, nor does it identify specific individuals targeted by the phone calls. This trend emerges against a backdrop of escalating threats against cloud productivity suites used by global enterprises. Microsoft 365 environments remain primary targets for malicious actors seeking unauthorized access to sensitive corporate data, intellectual property, and communication channels.

The utilization of advanced techniques such as multi-factor authentication bypassing and session hijacking reflects a broader shift away from brute-force password attacks toward adversary-in-the-middle strategies. Security researchers tracking tools like Knight Office and BigBear 2.0 note that these kits are specifically designed to subvert modern security baselines that rely solely on standard multi-factor authentication prompts. Observers and security teams are monitoring the situation to see how vendors and affected entities respond to the BigBear and Knight Office threats. Coverage does not currently specify immediate remediation timelines, law enforcement involvement, or official patches from Microsoft regarding the specific attack vectors described. Future updates from reporting outlets and threat intelligence firms like CloudSEK are expected to provide further technical indicators of compromise and additional mitigation strategies for enterprise defenders attempting to secure their executive personnel against telephone-based social engineering and advanced phishing frameworks.