Fake IT helpdesk calls your staff: the phishing wave that bypasses even MFA

Picture this: an employee gets a phone call or a Teams message from someone who says they are the IT helpdesk. There is an urgent problem, and the caller sounds friendly and believable. That exact scenario sits behind two active attack campaigns that compromised thousands of Microsoft 365 accounts this summer and autumn. They even bypass multi-factor authentication (MFA). Security researchers at CloudSEK and Arctic Wolf mapped the scale in early September, and the campaigns were still running at the time of writing.

How it works: the attack runs on trust

The attackers operate under two names. BigBear 2.0 is a ready-made phishing kit that criminals rent. PREY-0058 is the name researchers gave to one of the groups. They don't use a complicated technical exploit. They call, send a Teams message or an email, and pose as an IT staff member who has come to fix a problem. Then one of two things happens. Either they persuade the employee to grant remote access to their device, or they send them to a convincing fake of the Microsoft 365 sign-in page.

That is where it becomes really dangerous. The fake page is more than a copy. It acts as an attacker-in-the-middle: everything the employee types, from username and password to the MFA code, is passed on in real time to the real Microsoft server. The attacker then takes over the valid, signed-in session itself. To the victim, it feels like a normal, successful sign-in.

Why ordinary MFA doesn't protect against this

Every organisation needs to understand this point. An MFA code you confirm through an app, a text message or a push notification only proves that you approved something at that moment. It does not prove that you did so on the real Microsoft site. If a fake page intercepts the code and relays it straight away, the MFA barrier has been cleared without anything looking odd.

The numbers show how well this works: more than 5,000 stolen credential records, including 474 sessions where MFA was fully bypassed and more than 4,000 hijacked session cookies, spread across more than 40 countries. Of the 461 targeted organisations, 258 were actually compromised.

What does protect: phishing-resistant MFA

There is a kind of authentication that holds up against exactly this scenario: phishing-resistant MFA. Think of passkeys and physical security keys such as YubiKeys, built on the FIDO2 and WebAuthn standards. The difference is fundamental. These methods bind the sign-in cryptographically to the real, verified web address. A fake page cannot copy that binding, however convincing it looks. Even if an employee clicks a phishing link in complete good faith, the sign-in simply does not work on the wrong site.

This ties in directly with Microsoft's move to passkeys this autumn. These campaigns show why that move is so urgent.

What you can do now

• Roll out phishing-resistant MFA wherever you can. Start with the users who have the most access, such as management, finance and IT administration.
• Use Conditional Access policies that add extra checks to sign-ins from unexpected locations or new devices, or block them.
• Limit what users can search across SharePoint and OneDrive. The researchers see that after a successful break-in, attackers mainly take data out in bulk from Outlook, Teams, SharePoint and OneDrive. They rarely deploy ransomware.
• Teach your people one firm rule: the IT helpdesk never calls out of the blue to ask for a password or MFA code, and never asks for remote access unless you asked for help yourself. That one clear agreement stops most of these attempts at the source.

Conclusion

These campaigns are not an exception. They show where things are heading. Social engineering by phone and Teams, combined with technically advanced phishing infrastructure, is the main attack route today. It works precisely because it targets people rather than technology. Do you want to know how exposed your organisation is to this scenario today, and which steps have the most effect? A focused security review maps that out.