A new type of phishing attack reportedly compromised access to Microsoft 365 at more than 340 companies over a 5-week period. The attacks are spreading by bypassing MFA.
The article reports that Microsoft 365 accounts were subjected to unauthorized access over a 5-week period, affecting more than 340 companies. The article provides details on the scale and targets of the incidents.
The attack involves stealing credentials through a new type of phishing and bypassing MFA to maintain unauthorized access to Microsoft 365. The article explains technical aspects of the attack, including an execution method targeting OAuth-related operations.
The article cites information dated 13:00 on 10 August 2026 as the time of the incidents and concludes by indicating that further updates are awaited.