One phone call, one SMS code spoken aloud, and a Microsoft 365 account flipped to attacker control without a fake login page or malware. According to Sophos X-Ops on 19 October 2026, a threat actor impersonating help desk convinced an employee to provide the SMS-based MFA verification code during self-service password reset, completed the reset from an attacker-controlled IP, registered a new Windows device in Entra ID within minutes, obtained a Primary Refresh Token, and used that session for Graph reconnaissance, mailbox access, about 100,000 SharePoint file downloads, Salesforce sign-in, and export of roughly 2,500 ServiceNow sys_user records. The victim organization is not named in the public write-up.
The helpdesk call that finished SSPR
According to Sophos X-Ops, the affected user later reported that the caller posed as help desk personnel and convinced them to provide the SMS-based MFA verification code needed to complete the reset flow. The password reset finished from an attacker-controlled IP. Sophos stresses that this initial access method bypassed the need for a phishing page, malware, or an OAuth consent prompt.
The transferable factor was the SMS verification code in the Microsoft 365 SSPR path. The user did not need to click a spoofed origin or approve a push on a reverse proxy. They read a short code into a live call while the actor drove the legitimate reset, moving a transferable second factor to the attacker in real time.
Sophos also notes an anomalous, geographically unusual SSPR initiation from a different IP the day before the confirmed compromise. Whether that attempt was the same actor is not established in the public reporting. The successful path is established: SSPR completed with the spoken SMS code, then immediate follow-on activity from the new password.
The organization later sent a company-wide vishing warning after other employees reported suspicious calls. The targeted user was already compromised when that message went out. Sophos reports the actor reviewed the organization's own vishing-awareness notification in the mailbox and deleted that message, with cleanup limited to two messages. No inbox rules and no new apps were created in the evidence Sophos reviewed.
Password reset to Primary Refresh Token in minutes
Activity moved quickly after the reset. Within minutes, a new Windows device appeared in Entra ID. The actor obtained a Primary Refresh Token and established Microsoft Edge authentication in a token-backed device context. That device-backed session is what later sign-ins treated as already authenticated.
From there the activity looks like ordinary cloud work, not a noisy implant. Sophos describes My Apps usage, Microsoft Graph reconnaissance, access to the user's mail and shared mailboxes, Teams launch, and bulk SharePoint collection. Investigators counted approximately 100,000 unique SharePoint files downloaded from Unified Audit Logs analysis. SharePoint searches used terms related to passwords, credentials, VPN access, SSH, AWS, SSN, and the organization's identity verification vendor, including misspelled variants. Over 100 unique mail items were accessed across user and shared mailboxes. Mail searches focused on credentials, customer information, and org structure.
Federated SaaS came next on the same session. Sophos reports SAML sign-ins to Salesforce and ServiceNow that rode the PRT-backed Entra session. In the sign-in records reviewed, later ServiceNow access was recorded as SAML 2.0 authentication using a primary refresh token, with MFA listed as "Previously satisfied." Salesforce access was confirmed; containment actions included SuspiciousActivity, FreezeUser, and SendEmail. Sophos does not show large-scale Salesforce CRM extraction in the reviewed evidence. ServiceNow produced an export of approximately 2,500 records from the sys_user table.
| Control surface | What Sophos observed | Why it did not stop the path |
|---|---|---|
| SSPR SMS MFA | Code read aloud on vishing call | Transferable recovery factor |
| Password after reset | Reset from attacker IP | Password became attacker-owned |
| Entra device + PRT | New Windows device minutes later | Session treated as legitimate |
| Federated SAML apps | MFA "Previously satisfied" | No fresh interactive step-up |
SSO and federation amplified the single reset. One Entra session with a device-backed PRT unlocked Graph, mail, SharePoint, Salesforce, and ServiceNow without repeating a full interactive MFA ceremony at each app. One stolen upstream proof therefore unlocked many apps without a new challenge.
Sophos frames the case against a broader operational pattern seen in SaaS extortion activity associated with GOLD CRYSTAL (ShinyHunters) style campaigns: vishing and credential work to obtain SSO access, then fan-out into cloud applications for reconnaissance and data theft. Sophos cites that pattern as adjacent context, not as named attribution for this specific intrusion. No threat group is confirmed for this incident in the public post.
What the evidence does not show
Several facts remain unconfirmed in the public reporting. The victim organization is unnamed. Exact headcount of affected individuals is not confirmed beyond the file and record counts above. Day-prior anomalous SSPR is not proven as the same actor. Large-scale Salesforce extraction is not shown. Malware and infostealers on an endpoint are not part of the reported chain. Temporary Access Pass issuance, AiTM reverse-proxy capture, and malicious OAuth app persistence are not described here.
The public reporting describes a recovery flow that accepts an SMS code a human can speak as a remote takeover path. Once the password and then the PRT exist for the attacker, Graph, SharePoint, and federated SAML apps behave as designed for a signed-in user. Revoking sessions and freezing SaaS users is cleanup after the fact. It does not rewrite the moment the SMS code left the phone on the call.
Helpdesk-themed social engineering keeps showing up in workforce identity failures for the same structural reason. Whether the call tricks IT into a reset or tricks the employee into reading a recovery code, the transferable factor is the prize. In this Sophos case the prize was the SSPR SMS verification code, and the payout was a device-backed cloud session that SSO happily reused.
Prevention centers on removing verbally transferable recovery codes from workforce identity. Malware on a machine that already holds a legitimate session is a different and harder problem; this intrusion never needed that bar. If you want to skip the attack details and go straight to what can stop this, read the related article on mfa2point0.com: phishing-proof recovery that blocks SSPR SMS vishing.
FAQ
How did attackers take over the Microsoft 365 account in the Sophos X-Ops SSPR case?
Attackers took over the Microsoft 365 account in the Sophos X-Ops case by impersonating help desk on a vishing call and convincing the employee to provide the SMS-based MFA verification code during self-service password reset. According to Sophos X-Ops, the password reset completed from an attacker-controlled IP without a phishing page, malware, or OAuth consent prompt.
What is a Primary Refresh Token and why did it matter after the SSPR reset?
A Primary Refresh Token mattered after the SSPR reset because it anchored a persistent device-backed Entra session. According to Sophos X-Ops, within minutes of the password reset the actor registered a new Windows device in Entra ID, obtained a PRT, and used Microsoft Edge authentication in a token-backed device context that later access treated as already authenticated.
Did MFA stop Salesforce and ServiceNow access after the Microsoft 365 takeover?
MFA did not present a fresh barrier at Salesforce and ServiceNow after the Microsoft 365 takeover in the Sophos X-Ops case. Sophos reports federated SAML sign-ins that used the PRT-backed Entra session, with ServiceNow recorded as SAML 2.0 authentication using a primary refresh token and MFA listed as "Previously satisfied."
How much data did Sophos X-Ops attribute to this identity intrusion?
Sophos X-Ops attributed approximately 100,000 unique SharePoint files downloaded, roughly 2,500 ServiceNow sys_user records exported, and over 100 unique mail items accessed across user and shared mailboxes. Salesforce access was confirmed, but large-scale CRM extraction was not shown in the reviewed evidence, and the victim organization was not named.
Was this the same actor as GOLD CRYSTAL or ShinyHunters?
Public reporting does not attribute this specific Sophos X-Ops intrusion to GOLD CRYSTAL or ShinyHunters. Sophos cites Mandiant-described vishing-to-SSO-to-SaaS extortion patterns as adjacent operational context, not as confirmed attribution for the unnamed organization's incident.
