Sophos X-Ops: help-desk vishing call and SMS self-service password reset gave an attacker a Microsoft 365 identity, then ~100,000 SharePoint files and a 2,500-record ServiceNow user-table export
Sophos X-Ops Incident Response published a case study on 19 October 2026 of an intrusion at an unnamed organisation. Several staff got calls from someone posing as the help desk; one user read out the SMS code for a self-service password reset (SSPR), letting the attacker reset the password, register a new Windows device in Entra ID and use a Primary Refresh Token for a durable session. From there the attacker ran Microsoft Graph reconnaissance (licences, organisation, tenant relationships, directory roles, service principals, domains, users), opened more than 100 mail items across the user's and shared mailboxes, searched SharePoint for terms such as password, cred, AWS, VPN, SSH, SSN and the organisation's own identity-verification vendor, downloaded about 100,000 SharePoint files, and launched Teams. Federated SAML sign-ins, with MFA shown as previously satisfied, took the attacker into Salesforce, where automated anomaly detection froze the account, and ServiceNow, where the sys_user table (about 2,500 records of names, emails, phones, roles and managers, depending on configuration) was exported as CSV and the CMDB computer list was browsed. The attacker created no inbox rules but deleted the organisation's own vishing warning email from the user's mailbox. Sophos compares the pattern to ShinyHunters-linked SaaS extortion activity reported by Mandiant. No ServiceNow or Microsoft vulnerability was involved. Primary: Sophos.
- Product
- Microsoft Entra ID / Microsoft 365 with federated SaaS (Salesforce, ServiceNow)
- Versions
- n/a — identity abuse, no software flaw
- Exploited in Australia?
- unknown
- Patch to
- Remove SMS and voice from self-service password reset where you can, or exclude admins and alert on SSPR from unusual locations; require MFA or a compliant device for 'Register or join devices' and alert on any new device registration soon after a password reset. When containing an identity compromise, revoke sessions and refresh tokens in Entra and in every federated app, not just the password. Add detections for bulk exports of ServiceNow sys_user and cmdb_ci_computer, Graph directory enumeration from one session, and SharePoint searches for credential terms. Tell staff the help desk will never ask for an MFA code by phone.
Primary: Sophos X-Ops — Beyond the mailbox: Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion (19 Oct 2026) · Talkback — resource listing (20 Oct 2026)