[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFXAkbj-GqxI3ZMh8ZHFBd6gNf3pAHSoFrI2pB63NaSk":3},{"article":4,"iocs":49,"watch_terms":53,"solutions":54,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"8c7fdd59-7a8d-4813-8c75-5a656222089f","Voice Callers Exploit BYOD to Reach Microsoft 365, Corporate Data","voice-callers-exploit-byod-to-reach-microsoft-365-corporate-data-432786","Threat actors are leveraging Microsoft's Graph API to identify lucrative targets, then passing their access to extortion groups like ShinyHunters.","Threat actors are exploiting Bring Your Own Device (BYOD) policies to gain access to corporate Microsoft 365 environments. They leverage Microsoft's Graph API to identify high-value targets and then sell this access to extortion groups, such as ShinyHunters. This tactic bypasses traditional security measures by exploiting legitimate API access.","Attackers use Graph API to find Microsoft 365 targets for extortion groups.","https:\u002F\u002Fwww.darkreading.com\u002Fthreat-intelligence\u002Fvoice-callers-exploit-byod-microsoft-365-corporate-data","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblte683970072b53815\u002F6aa308b0b1def869502ac7be\u002FPhone_passcode-Tero_Vesalainen-Getty.jpg?width=720&quality=80&disable=upscale","2026-09-10T20:36:03+00:00","2026-09-10T22:00:20.908846+00:00",7,[17,20,23,25],{"name":18,"type":19},"BYOD","technology",{"name":21,"type":22},"Microsoft 365","product",{"name":24,"type":19},"Graph API",{"name":26,"type":27},"ShinyHunters","threat_actor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":28,"icon":30,"name":31,"slug":32},null,"Threat Intelligence","threat-intelligence",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",[50],{"type":51,"value":26,"context":52},"malware","Extortion group leveraging compromised access",[21],{"controls":55,"vendors":131},[56,84,113],{"slug":57,"name":58,"problem":59,"products":60},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[61,69,76],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":57,"product_name":73,"url":74,"description":75},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":85,"name":86,"problem":87,"products":88},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":114,"name":115,"problem":116,"products":117},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[118,123],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":119,"product_name":120,"url":121,"description":122},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[132],{"slug":106,"name":107,"logo_path":108,"roles":133},[134],"affected",{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":153},"byod-devices-used-as-launchpad-to-compromise-microsoft-365-via-graph-api","BYOD Devices Used as Launchpad to Compromise Microsoft 365 via Graph API","Threat actors are exploiting permissive BYOD policies to register personal devices into corporate Microsoft 365 environments, gaining legitimate API-level access to sensitive data. By abusing Microsoft's Graph API, attackers can enumerate high-value targets and exfiltrate data while appearing as authorized users, effectively bypassing perimeter-based security controls. This attack chain is particularly dangerous because it leverages trusted, legitimate infrastructure rather than malware, making detection significantly harder. The subsequent sale of this access to extortion groups like ShinyHunters amplifies the downstream risk, turning an access control gap into a full-scale data breach and extortion event.",[140,141,142,143,144,145,146,147,148,149,150,151,152],"CIS Control 1: Inventory and Control of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-124: Guidelines for Managing the Security of Mobile Devices","NIST AC-2: Account Management","NIST AC-17: Remote Access","NIST AC-20: Use of External Systems","NIST IA-3: Device Identification and Authentication","NIST SI-4: System Monitoring","GDPR Article 32: Security of Processing","ISO 27001 A.6.2.2: Teleworking","ISO 27001 A.9.1.2: Access to Networks and Network Services","ITIL Service Transition: Change and Configuration Management",{}]