Attackers call employees’ personal phones to break into Microsoft 365 accounts Attackers are calling or texting employees on their personal phones, posing as internal IT staff, in a social engineering campaign that tricks them into handing over access to corporate cloud accounts. Once inside, they pull files and email from Microsoft 365 apps, SharePoint, OneDrive, and inboxes, for weeks at a time, according to Microsoft Security Research. (Source: Microsoft) Researchers have been tracking the campaign since May 2026. Because the initial contact often happens on a personal phone that isn’t managed by the company, it can leave little behind for investigators to find. In several reviewed cases, the only lead was an employee remembering the call or text. “The caller creates a sense of…