Voice Callers Exploit BYOD to Reach Microsoft 365, Corporate Data

Threat actors are exploiting permissive BYOD policies to register personal devices into corporate Microsoft 365 environments, gaining legitimate API-level access to sensitive data. By abusing Microsoft's Graph API, attackers can enumerate high-value targets and exfiltrate data while appearing as authorized users, effectively bypassing perimeter-based security controls. This attack chain is particularly dangerous because it leverages trusted, legitimate infrastructure rather than malware, making detection significantly harder. The subsequent sale of this access to extortion groups like ShinyHunters amplifies the downstream risk, turning an access control gap into a full-scale data breach and extortion event.