Sophos Says a Fake Help Desk Call Unlocked a Microsoft 365 Password Reset, a Rogue Entra Device and a ServiceNow Export of About 2,500 User Records

NEW YORK - A phone call from someone posing as the help desk was all it took. An employee read out an SMS verification code, and within minutes an intruder had reset the employee's Microsoft 365 password, registered a new Windows device to the account and begun moving through the company's software-as-a-service estate, according to an incident write-up from Sophos.

The case, published Monday by Andrew Bonwell of the Sophos X-Ops Incident Response team, traces a single compromised identity from a self-service password reset to Microsoft Graph reconnaissance, about 100,000 SharePoint file downloads, a Salesforce sign-in and an export of roughly 2,500 user records from ServiceNow. The intruder used no malware, no phishing page and no OAuth consent prompt, and created no inbox rules, forwarding rules or new applications.

"The mailbox is rarely the destination anymore; it is just the first room the attacker walks through," Sophos wrote.

From reset code to device-backed session

Several employees had reported suspicious calls, and the organization sent a company-wide warning, but one user had already been compromised. The caller impersonated help desk staff and persuaded the user to provide the SMS code needed to finish the reset. Telemetry also showed an earlier reset attempt from a geographically anomalous address the day before, which Sophos could not tie definitively to the attack.

Within minutes of the reset, a new Windows device was registered in Entra ID, a Primary Refresh Token was used successfully and Microsoft Edge authenticated in that device context. Later ServiceNow access was recorded as SAML 2.0 authentication using a Primary Refresh Token, with multifactor authentication listed as "Previously satisfied," which Sophos reads as the actor riding an existing cloud session into federated apps rather than reauthenticating at each one.

Graph, SharePoint and the warning that vanished

Sophos found Graph queries in GraphApiAuditEvents from Microsoft Defender consistent with mapping directory roles and effective permissions, enumerating enterprise applications and service principals, listing verified domains and counting users. Unified Audit Logs showed more than 100 unique mail items accessed across the user's mailbox and shared mailboxes. SearchQueryInitiatedSharePoint events captured searches for terms including password, cred, aws, vpn, ssh and SSN, and four recovered queries named the organization's identity verification vendor.

One message the intruder read was the company's own vishing warning. It was then deleted from the mailbox, along with one other message. Microsoft Teams was launched, and Sophos notes that Microsoft does not audit passive viewing of existing chats, leaving no record of what was read.

Salesforce froze, ServiceNow did not

The intruder reached Salesforce through federated sign-in, but Salesforce logged a SuspiciousActivity event followed by FreezeUser and SendEmail, its automated containment freezing the account and alerting the administrator. Sophos found no large-scale CRM extraction. ServiceNow was the largest non-Microsoft impact: repeated views of the sys_user list, an export and a read of the generated sys_user.csv, with export metadata indicating about 2,500 records. The same session browsed the cmdb_ci_computer list view, with no export found. The organization kept receiving phishing and vishing attempts afterward, which Sophos says may have used the exported data.

What defenders can do

• Alert on any new Entra ID device registration shortly after a password reset or MFA method change, require MFA on device registration itself, and revoke the identity's sessions until a person confirms the device.
• Move recovery toward phishing-resistant methods, tightly scope or remove SMS in self-service reset, and treat reset requests from anonymizing infrastructure or unexpected locations as detection signals. Tell staff the help desk will never ask for a code by phone.
• Contain beyond the password: revoke sessions and refresh tokens in Entra ID and in every federated SaaS app the identity could reach, and add ITSM and CRM platforms to the incident response runbook.
• Hunt GraphApiAuditEvents for directory, role and service principal enumeration from one session, SharePoint searches for credential terms or your MFA vendor's name, MailItemsAccessed spikes on security notices followed by deletion, and first-time federated SAML sign-ins where MFA was satisfied by an existing token.
• Watch for bulk exports of the ServiceNow sys_user and cmdb_ci_computer tables, which Sophos calls a strong investigative signal, and of CRM tables in other federated apps.