Dark Reading reports that attackers are combining voice calls with bring-your-own-device (BYOD) access to reach Microsoft 365 environments. The tactic lets them get close to corporate data by exploiting devices and identities that employees use for both personal and work purposes.
According to the report, the activity uses Microsoft's Graph API to identify high-value targets inside an organization. Once those accounts are pinpointed, the attackers pass access to extortion-focused groups, including ShinyHunters.
Beyond that high-level flow, the report does not detail the exact techniques used during the voice calls or the specific Graph API endpoints involved. With only one source available, there are no contrasting accounts to compare here; the summary above reflects that single reporting.