Threat actors are using voice calls to socially engineer employees into granting access to corporate Microsoft 365 accounts through Bring Your Own Device environments, then using Microsoft Graph API to enumerate corporate structure, identify sensitive data, and map user privileges before passing compromised access to extortion groups like ShinyHunters, according to analysis published by Dark Reading on September 10.
Vishing Targets BYOD Gaps in Corporate M365 Security Posture
The attack begins with voice calls — a technique known as vishing — aimed at employees who access corporate Microsoft 365 accounts from personal devices. BYOD policies create a security gap: personal devices with corporate account access are often less protected than managed endpoints, lacking endpoint detection tools, strict configuration enforcement, and centralized monitoring that IT teams apply to company-owned hardware.
Microsoft Graph API Enables Corporate Enumeration After Initial Compromise
Once attackers obtain access to a corporate Microsoft 365 account, they use Microsoft Graph API to systematically enumerate the organization’s structure. Graph API provides programmatic access to user directories, organizational hierarchies, document libraries, and permission mappings. Attackers query these endpoints to identify high-value targets, locate sensitive data repositories, and understand privilege relationships that enable further compromise.
Compromised Access Passed to Extortion Groups Like ShinyHunters for Data Theft
After mapping the corporate environment through Graph API, attackers pass the compromised access to extortion groups like ShinyHunters. These groups specialize in data theft and ransom demands, using the enumerated intelligence to identify which data sets carry the highest extortion value and which users have access to crown jewel systems.
BYOD, MFA Enforcement, and Graph API Permissions as Control Points
BYOD policies create the initial access opportunity by extending corporate authentication to less-protected personal devices. Even when multi-factor authentication is enforced, social engineering through voice calls can convince users to approve MFA prompts on their personal devices, where they may be less vigilant about suspicious requests than they would be on corporate-managed systems.
Personal devices often lack endpoint detection and response tools, centralized patch management, and configuration enforcement that IT teams apply to corporate-issued hardware. Users may install risky applications, delay operating system updates, or use weak device passwords on their personal phones and laptops. When these devices have access to corporate Microsoft 365 accounts, they create a lower-security path into the enterprise environment that attackers can exploit through social engineering.
Graph API permissions determine what attackers can enumerate after gaining initial access. Organizations that grant broad Graph API read permissions to standard user accounts enable comprehensive corporate mapping through a single compromised credential. Restricting Graph API permissions to only the scopes each user legitimately requires limits what attackers can discover after initial compromise.
Default Microsoft 365 configurations often grant users broad read access to organizational directories, user profiles, and group memberships under the assumption that employees need this information for collaboration. However, these defaults also enable attackers who compromise a single account to query the entire organizational structure, identify high-value targets like executives or administrators, and locate sensitive data repositories. Least-privilege principles applied to Graph API permissions mean granting users only the specific API scopes their job functions require, rather than blanket directory read access.
Security researchers warn organizations to strengthen BYOD policies by requiring conditional access policies that restrict corporate account use from personal devices, enforce device compliance checks even on BYOD endpoints, and implement anomaly detection for Graph API queries. Monitoring for unusual enumeration activity — such as rapid querying of user directories or organizational charts by accounts that do not typically access those resources — can detect post-compromise reconnaissance before extortion groups receive the compromised access.
The handoff to extortion groups like ShinyHunters represents a division of labor in the cybercrime ecosystem: initial access specialists focus on social engineering and account compromise, while extortion specialists handle data theft and ransom negotiations. This separation allows each group to specialize in their core competency and increases overall campaign effectiveness compared to end-to-end operations conducted by a single group.
