FBI Warns Microsoft Users—New Attack Gains Access To Accounts

A sophisticated new phishing campaign targeting Microsoft users has prompted an urgent FBI warning, with attackers exploiting advanced social engineering to bypass multi-factor authentication and gain full account access. The FBI has issued a public alert after detecting a sharp rise in successful intrusions against Microsoft 365 accounts, urging users to scrutinize emails requesting password resets or security verification. This attack, primarily distributed via convincing emails that mimic official Microsoft correspondence, leverages a novel technique that intercepts authentication tokens, rendering typical security measures ineffective. Security experts at CrowdStrike and Mandiant have confirmed the campaign's ability to harvest credentials and session cookies, even from users who have enabled two-factor authentication. The threat actors, believed to be an advanced persistent threat group with ties to Eastern Europe, have targeted government agencies, financial institutions, and high-value corporate executives. Victims report receiving emails with near-perfect branding, urgent subject lines like 'Unusual Sign-In Activity Detected,' and links leading to fraudulent login pages that capture both passwords and MFA codes in real time. The FBI advises that no legitimate Microsoft communication will ask for passwords or verification codes via email, and recommends enabling device-based authentication, reviewing account sign-in activity weekly, and using a dedicated authentication app rather than SMS. As the attack evolves, security researchers warn that similar techniques may soon target Google, Apple, and other major platforms, making this a watershed moment for online account protection. Users are urged to report suspicious emails to the FBI's Internet Crime Complaint Center (IC3) and to deploy endpoint detection tools that can flag token theft. The coming weeks will likely see a surge in credential-stuffing attempts using harvested tokens, and organizations should conduct simulated phishing drills to harden human defenses.