Voice Callers Exploit BYOD to Reach Microsoft 365, Corporate Data

If your company allows BYOD, your organization's Microsoft 365 data is now at risk of being exfiltrated by external threat actors.

Threat actors are exploiting a vulnerability in Bring Your Own Device (BYOD) policies to gain unauthorized access to Microsoft 365 and corporate data. These attackers are reportedly using Microsoft's Graph API to identify high-value targets within organizations. Once identified, the access gained is then transferred to other extortion groups, such as ShinyHunters. This method bypasses traditional security measures by exploiting the trust placed in user-owned devices connecting to corporate networks and cloud services.

The use of Microsoft's Graph API by threat actors to map out targets signals a sophisticated approach to cyber-espionage and data theft, moving beyond brute-force attacks. This method allows attackers to efficiently locate corporate resources and sensitive information by querying available data and user access permissions. The subsequent handover of access to dedicated extortion groups like ShinyHunters suggests a specialized division of labor within the cybercrime ecosystem, where initial access brokers sell their findings to ransomware or data-leakage operations.

This exploitation of BYOD policies highlights a significant blind spot in corporate security strategies, as devices not fully managed by the organization present an inherent risk. The reliance on user-owned hardware for accessing critical business systems can introduce vulnerabilities that IT departments may not be able to fully monitor or control. Organizations must reassess their BYOD security protocols and consider stricter controls or alternative solutions to prevent such targeted data breaches from occurring.