That “IT Support” Call Could Be the Attack: A New Microsoft 365 Threat Targets Business Leaders

A phone call from “IT support” may feel more trustworthy than an unexpected email. The caller may know an employee’s name, title, company, and email address. They may even sound patient and professional.

That familiarity is exactly what makes a newly reported Microsoft 365 attack so dangerous.

In September 2026, Arctic Wolf described an active campaign in which criminals call business leaders while pretending to represent an internal IT department or help desk. The callers direct their targets to convincing account-registration or passkey websites. If the employee follows the instructions, the attackers may gain access to Microsoft 365 and other cloud services.

The lesson for small businesses is simple: phishing no longer arrives only through email. It can begin with a helpful-sounding phone call.

How the Fake IT Call Works

The campaign is being tracked as PREY-0058. According to Arctic Wolf, the attackers have frequently targeted directors, vice presidents, executives, and IT personnel.

The call may claim that the employee needs to:

• Register a new passkey
• Reconnect Microsoft 365
• Confirm a security change
• Update multifactor authentication
• Resolve an account or sign-in problem

The caller then sends or dictates a website address that appears to relate to the company or Microsoft 365. The page is controlled by the attacker, even if it looks like a normal sign-in screen.

When the victim enters a password and approves a verification request, the attacker may capture enough information to take over the active cloud session. This can let the criminal access email, SharePoint sites, OneDrive files, and other connected services.

Why Multifactor Authentication May Not Be Enough

Multifactor authentication, often called MFA, is still an important security control. It normally requires something beyond a password, such as an app approval, security key, or device-based confirmation.

The problem arises when an employee is persuaded to approve the attacker’s sign-in.

In this campaign, the criminal is not necessarily breaking the MFA system. The attacker is manipulating the person into completing the authentication process for them.

That is why unexpected verification requests should never be approved simply because someone on the phone says they are from IT.

Businesses should also work toward phishing-resistant sign-in methods, such as properly configured passkeys or physical security keys. These methods can provide stronger protection against fake login pages, but they still require careful setup and clear employee instructions.

Why Business Leaders Are Attractive Targets

Executives and managers often have access to more information than an average employee. Their accounts may contain contracts, employee records, financial discussions, customer information, strategic documents, or confidential email.

They are also busy. A convincing caller who creates urgency may be able to pressure an executive into acting before checking the request.

Small companies are not immune. In a smaller Orlando business, one owner or office manager may have access to nearly every shared document, mailbox, vendor relationship, and financial workflow.

A compromised account may therefore expose a large portion of the company’s information without the attacker ever installing traditional malware.

Establish a Simple Verification Rule

Every business should adopt one clear rule:

Employees should independently verify unexpected requests involving passwords, passkeys, MFA, remote access, or account changes.

That means ending the call and contacting the real IT provider through a known number, support portal, or previously saved contact.

Do not use a telephone number, website, or contact method supplied by the unexpected caller. Caller ID is not enough because displayed numbers and names can be misleading.

Employees should understand that pausing to verify a request is not rude or uncooperative. It is the correct security response.

Warning Signs Employees Should Recognize

Treat a support call as suspicious when the caller:

• Contacts you unexpectedly about an account problem
• Creates pressure to act immediately
• Sends an unfamiliar login or passkey-registration link
• Asks you to approve an MFA notification
• Requests your password, verification code, or recovery code
• Wants to install remote-access software
• Discourages you from contacting your usual IT provider
• Claims the request must remain confidential

A legitimate technician should be comfortable with independent verification.

What Small Businesses Should Do Now

First, tell employees that criminals may impersonate internal IT staff by phone, text message, or collaboration platform.

Next, document how genuine support requests will be handled. Employees should know the official telephone number, support portal, and people authorized to request account changes.

Businesses should also review:

• Whether MFA is required on every Microsoft 365 account
• Whether stronger, phishing-resistant authentication is available
• Which employees have administrative or broad file access
• Whether former employees and unused accounts have been removed
• Whether unusual sign-ins and large file downloads are monitored
• Whether employees know how to report a suspicious call quickly

These controls help reduce both the likelihood and potential impact of an account compromise.

What to Do After a Suspicious Call

If an employee only received the call and did not follow its instructions, report the attempt internally so other staff can be warned.

If the employee visited the website, entered information, approved an authentication request, installed software, or allowed remote access, contact the company’s trusted IT provider immediately. The account, active sessions, authentication methods, email rules, file activity, and device may all need to be reviewed.

Avoid trying random fixes or deleting information that could help determine what happened.

Cybernetic Networks helps Orlando and Central Florida businesses secure Microsoft 365, strengthen account protections, train employees around real-world scams, and investigate suspicious sign-in activity. If an unexpected “IT support” call has raised concerns, our team can help you verify the situation and protect the business without adding unnecessary confusion.

Source Links

• Arctic Wolf: Active Cloud Data Theft and Extortion Campaign Targeting Microsoft 365 and SaaS Platforms
• Microsoft: Protect Yourself From Online Scams and Attacks
• CISA: Require Multifactor Authentication