# Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks

> **Open Intelligence Dossier** · First detected: 2026-09-08 07:07 UTC · Category: Technology

## Executive Summary
Fake IT help desk calls and sophisticated phishing kits are targeting Microsoft 365 users globally to bypass multi-factor authentication.

## Intelligence Brief
Recent coverage from outlets including The Hacker News, The Register, TechRadar, Computerworld, Security Affairs, Windows Report, IT Security Guru, BleepingComputer, and CloudSEK details significant cybersecurity threats targeting Microsoft 365 users across the world. Specifically, fake IT help desk calls and phishing emails are being utilized to target executives and other users in data theft and extortion attacks. Reports highlight that the BigBear phishing crew, along with a campaign designated as BigBear 2.0 utilizing Evilginx2, has netted thousands of Microsoft 365 credentials. According to the reporting by BleepingComputer, the BigBear Microsoft 365 phishing service successfully bypassed multi-factor authentication at two hundred fifty-eight organizations.


Windows Report specifies that the campaign has stolen five thousand credentials, while IT Security Guru notes the deployment of a new 'Knight Office' phishing kit that steals logins without touching a password. Additional mechanics highlighted in the coverage involve session hijacking that occurs after multi-factor authentication has already been completed by the targeted users. This trend emerges as a major multi-pronged threat landscape involving two distinct campaigns hitting Microsoft 365 users globally. The utilization of fake IT help desk impersonation represents a significant evolution in social engineering tactics, allowing malicious actors to trick individuals into granting access.


Security researchers and tracking organizations such as CloudSEK have been closely monitoring these operations, documenting how the infrastructure facilitates widespread credential harvesting and unauthorized session access across diverse corporate networks. As coverage continues to develop, observers and security professionals are tracking the operational methods of the BigBear crew and the deployment of tools like the Knight Office phishing kit. Future reporting will likely follow further disclosures regarding the extent of organizational compromises, additional technical details about the Evilginx2 framework utilization, and potential mitigations deployed to counter IT help desk impersonation attacks and session hijacking vectors.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| The Register | BigBear phishing crew nets thousands of Microsoft 365 credentials | [Source Link](https://news.google.com/rss/articles/CBMivgFBVV95cUxQQmJVaGhrcF8yTk1Xd2ctQlhnTXU5Z3JVYW9UZVZHcDNOWWdxWmFqMGkyUjZZaGNoamNueUVmb0tQOEcyTHliMXNkTDdhYUNLQVNmWDI5bXVrRko1V2dVNzMtOVFuaENtRnFKenZ0TGw2ZFFjUHpzNzU1d2hyOE5yRDFuUk1pVHJsQWlRcXA5S09PT2NWYWs3SE5iS2FBY1RZQkd1Q2pONk5wcFJsM1FSUVFVWUVKeDlzdGljVWtR?oc=5) |
| TechRadar | Microsoft 365 users hit by two major threat campaigns - fake IT calls and phishing emails target users across the world | [Source Link](https://news.google.com/rss/articles/CBMi7AFBVV95cUxOZEFhU1luT2s5TEtNYVJfVWlxajNIMU9xc01pQnpDcXJLcmpXUkhWSWM5NFMyc29yb2FjcFh1T2Q1LUJhem1RbG42cXdxd25BcXFqUkpyT29xb2pTMkJJSllfUkhYb1YxQnRxWlNfVWRPak5EMWhaSVZubjBOaU1UaGFLYTl3RFQ1QktiREUwUkNBRjNJUlZCaUhvRXU0d0RHNlFNeTJHVEtnWGwtYWhyUHhyczZ1U3RCZ3FzVlk4QTNEVWI5akJia3cwZElXdU1EelM5TkhXcmdYZHJKMlEzUjdfalZ2emRELXhRYw?oc=5) |
| Computerworld | BigBear 2.0 phishing campaign hijacks Microsoft 365 sessions after MFA | [Source Link](https://news.google.com/rss/articles/CBMiwAFBVV95cUxQcFBqUlBHdmUxVHJkM0FwdDRvMDkxN1lPbkpHQ0ZaUENSUkl1LV9nZzdBTkVaa1lwZVdHMEFnODg0SlU0QlVtODBKbVVVc1pTVmU3R2xXZ2xwUnRCSXYydUd5ei02a21kVTdJdXV5RURlWU5Ud1dyWHdwSmxIeTJPcWlteEpvWjZzLWJzZVBjLVNfYjRVdEtHS3gwSUtYaDBrS1JpcXNBRGFLVEl0VVdaZnh2OThWWVlNY1JMeXJzY0Q?oc=5) |
| Security Affairs | IT Help Desk Impersonation Lets Hackers Bypass MFA | [Source Link](https://news.google.com/rss/articles/CBMipAFBVV95cUxPbTNFZ3lCdzNfLXNDTnNmMzF5Ym01UFpZQXVhWnY5U1pRVlhYVGdRVXRveFNrOHl1S19XcV9EckhSWVhSdGprdmdmc2JQWDdZQkRSUU1FelRDOVBvajgtUDJhQmVpUWM4VFpFN0JSeVBYajJZWXNFZUFxU3hvV1VscWp3OV8xR1prVExNSjNhc3RqclNCZzF1MG5EX3liUXVkZlVfVtIBqgFBVV95cUxOZlRWcnNGMTlRS1ZnekVrSGd5c0F2T3k1d0tWd2JKVXE2bV9KNjg2WkY4cnVySWdjZ3VtU21tNTdrX1h6elpObXhjTTFxWUZkVUgzRjllSTRBeXFMZ2wxbEhZSlBfdUNxZWFkejlLNEZwZGt6dzNMOTQtN2czek81R1B5ZnFfcU5kcW9YYTFiLVhYankzUVhBdzROc0ZaR0Q0LUFLRkYyd2pMQQ?oc=5) |
| Windows Report | BigBear 2.0 Phishing Campaign Steals 5,000 Microsoft 365 Credentials After Bypassing MFA | [Source Link](https://news.google.com/rss/articles/CBMitAFBVV95cUxPUGJLOGN3eDlQUkxKTk9FLXc1M256RFBMMDBUX0NoUzBGbVJ6bnpQNllVdWVvODk0SFp6dXZwOWhKTnJFb1g3RDRKSzQ3Q1h5NmlmN2xFR1VIU2FqZ3NvMzNJclF5bmxZOGVpS0FJQXRqNlBla2JtTDJ2NWdNU1R1S0NyNWpwa29MWTBHeFFSbFpuYVFnUnY5NkI3NlMwUkJGSktnQkFVV29pbGdCUk5PZmJoaDA?oc=5) |
| IT Security Guru | New ‘Knight Office’ Phishing Kit Steals Microsoft 365 Logins Without Touching a Password | [Source Link](https://news.google.com/rss/articles/CBMiyAFBVV95cUxNRnNtOU9zZmNKbFlSWmxFUWx2QXJ3bERtaFBGd3JaTDJSSDhETXF0R0xXdXBjS1U0Mk5JTm9oZ2QwbFlHY1ctMF95b0FzSGVSOFpFR3dkUFhWaUFJSnU2bl9vVmJKNy1XZkotdjZCS29aQVNFeXBza1VxVVZxdmIxZ0xwUU1oRHRwU3FtaFVkZWFObGYwbkRNaG13ZGF3c0U3dkdOMlUyYW5GeGRaeGlWY1dUbG92U1lHMldaYjlBY19zaUNDZmVUMQ?oc=5) |
| BleepingComputer | BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations | [Source Link](https://news.google.com/rss/articles/CBMivAFBVV95cUxNSjhmMUl6aGRhN2tBQk5iWVQyS0p3cC04eWdfZzFhRlR1VENhaml4YUVZTzZ5M2ZtLVBDdUV2WGd1VTNiSkhjdkdtWkoyMUg5cXhJLVNWdWtZTlhhN0llTnJTTndGX1pJb09INXpNNkUxemZZU0oyM212amMxNmxweUdwRnFnRlJ1N2JtSFRnOUdLZGduT2lZTGdSWk05WmVYU25fMjVmQWZhc3Fkem1QRzBWWHlTWDhTYVdmRNIBwgFBVV95cUxNM01JVkdaR1FxT0t0ZGlpUHg3eDd3VF9vdjdUeU1Zb2RIb2gwNGppM3pIMmVZU01oR2tTa0tmUWxmQXozbXFWcW94UURjVnVIU0NpbU54VWNzYnZfd29pd1l3SzFxVE04NU5OaklYRngtbF94dzJIVjJSeG9pRUFsMnpqSng1d0loYVR1Tzd3SGY0VHN2ck1) |
| CloudSEK | Tracking BigBear 2.0 Evilginx2 Phishing Campaign | [Source Link](https://news.google.com/rss/articles/CBMihAFBVV95cUxPenZyUGQ4eS1sbDE1X2dqV2xhWnJyc1MyRmZXMUJ0ODhWTVpidEl3MFRraDBPS2FsakwzTFlQZHNsdUkwSFhjUDBhclgxb3VEWlRyQkV0OHhxV1ktUTdfQ1UzZk5uYW16aUlyQXdFWFpUMEphMVM4NnRNNDB0d1pTZ1BpcFo?oc=5) |
| The Hacker News | Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks | [Source Link](https://news.google.com/rss/articles/CBMiggFBVV95cUxNME1xYkpOSGpYYlRBMXIwM3I2ZDBKeUlCMHdrbnhLQWxOUkl2UDVwcmptMWpiZFpsZVpvZWM4NzlOYldVTWpqb2lYUExvczVyUlJNcE1UU0N2X1ljbGhwT1Nqc0NTTVF1dkpqQXZLRGwtWmROQl9HUl9TemFienVockd3?oc=5) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-09-08/fake-it-calls-target-executives-in-microsoft-365-data-theft-and-extortion*