“Attackers access and download sensitive files, including financial assets, internal security protocols, and user credentials.”
Since late November 2023 one campaign has taken over hundreds of user accounts across dozens of Azure environments, senior executives included. The lure is a shared document with a “View document” link. Once inside, the attackers register their own MFA method and set mailbox rules to hide their tracks. MFA did not stop them. It became the lock they changed.