How Hackers Are Using Messaging Apps to Steal Microsoft 365 Credentials

Microsoft 365 account holders, it’s time to clutch your credentials like your last stick of office coffee—hackers have orchestrated another clever plot, this time through everyone’s favorite messaging apps. If you thought WhatsApp and Signal were just for family chats and cryptic office banter, think again. Russian threat actors have been sliding into inboxes and DMs, not to share a meme, but to swipe Microsoft account access with the world’s oldest trick: pretending to be someone trustworthy.

Digital DMs—Dangerous Messages​

Let’s start with the high drama. According to Bleeping Computer, these adversaries aren’t blasting spam across the internet indiscriminately; instead, they’ve crafted messages mimicking officials from European countries. Their prime targets? Employees at human rights organizations and those involved with Ukraine—because when it comes to high stakes, why not go for the politically charged jackpot?
The mechanics of this scam are depressingly simple. Hackers reach out via WhatsApp, Signal, or even from a hijacked Ukrainian government email account (extra flair for credibility), sending messages that appear as invitations to urgent meetings about Ukraine or other relevant social issues. We'll call this the cyber equivalent of a phishing rod baited with empathy and concern.
But here’s the catch: links in these messages redirect to malicious sites that hoover up logins and one-time codes, or they outright ask the recipient to hand over Microsoft authorization codes on a silver platter—no complex malware, just abusing trust and urgency.
Now, if you’re reading this and sighing, “Who falls for this stuff?”—first, congratulations, cybersecurity awareness posters have done their job. But don’t underestimate stress, distractions, or the reality that many of us have seen legitimate midnight Teams meeting invites that make just as little contextual sense.

Volexity Lifts the Lid​

Volexity, the eagle-eyed cybersecurity company tracking this ruse since March, goes into forensic detail about the attack methodology. Their blog lays it all out: the patterns, the lures, and even screenshots of the treacherous texts. Essentially, if you’re ever messaged from an official-seeming account about a sensitive event, especially one that issues a link to “join a secure meeting,” your scam senses should go from 0 to DEFCON 1.
These messages typically:

• Arrive unexpectedly, especially outside normal hours or from new contacts.
• Evoke urgency (“Action required about Ukraine,” or insert timely crisis here).
• Contain links masked as meeting invites or “emergency portals.”
• Directly or indirectly ask for codes, credentials, or verification steps.

What would a world-weary IT admin say? Probably, “This again? It’s like that time Steve from accounting plugged in the ‘free’ USB he found in the parking lot.” Because as much as attack vectors evolve, the human factor persists as the weak link.

Real Implications, Not Just Clickbait​

If this attack feels familiar, that’s because it is—business email compromise, social engineering, and phishing remain top attack methods year after year. The difference today is scale and targeting precision. Where once phishing campaigns hoped for a 1% click rate, these scams are surgical: tailored to victims who are likely under stress, holding sensitive roles, or just exhausted enough to fall for a plausible lie.
For IT and security professionals, it’s a chilling reminder: you can configure all the firewalls you want, but a single distracted employee can still open the door. And in this play, instant messaging is the new email—people trust its informality and speed, making it a perfect avenue for exploitation.

Microsoft Accounts: The Crown Jewels​

Why the focus on Microsoft 365, you ask? Simple: it’s everywhere in enterprise, government, and humanitarian circles. A compromised Microsoft account often means access to sensitive documents, communications, and—let’s get real—enough internal drama to fuel ten seasons of corporate reality TV.
Attackers with access to these accounts can:

• Steal or leak sensitive communications.
• Launch internal phishing attacks from trusted addresses.
• Reset passwords or lock organizations out of shared documents.
• Download or delete critical files.

And that’s only the beginning. Compromised credentials ripple through an organization, sowing confusion and breeding further vulnerabilities. Every IT pro has nightmare stories of “that one compromised account” that left digital scorched earth in its wake.

How to Spot (and Stop) the Scam​

So, how can you defend yourself against a WhatsApp or Signal-based sneak attack? Volexity (and, frankly, anyone who’s paid attention to the digital dark arts lately) recommends vigilance:

• Unsolicited Urgency: Treat urgent messages, especially those ostensibly from officials, with skepticism. If a random European dignitary needs your help to save democracy, pause and verify.
• Links Are Suspect: Never click links in messages from unknown sources. Hover to preview URLs when possible; on mobile, it’s trickier, so err on the side of caution.
• Guard Your Codes: Treat Microsoft authorization codes like you would your banking PIN. Sharing these with anyone—especially over messaging apps—is like giving away your house keys to a stranger at the bus stop.
• Out-of-Band Verification: If someone claims to be from your organization (or any legitimate institution), open a new communication channel to verify. Don’t reply to the suspect message; message or call via an official, previously used method.
• Train, Test, Repeat: Ongoing security awareness training might get groans from staff, but it’s the best defense against social engineering. Simulated phishing campaigns? Annoying, yes. Effective, absolutely.

Might as well add a reward system for reporting phishing, because nothing motivates like the promise of treats (or at least momentary recognition in your company newsletter).

The Broader Threat Landscape​

The timing and choice of targets here is no fluke: human rights organizations and Ukraine-linked groups are frequently in the crosshairs of state-sponsored actors. For such organizations, a single breach can mean not just financial loss, but endangerment of lives, exposure of confidential sources, and much more.
And in a world of remote work and BYOD (bring your own device) policies, teaching staff to treat WhatsApp and Signal as potential attack vectors—not just personal safe spaces—is more critical than ever. That official-looking message on a Saturday night? It might just as well be a wolf in sheep’s encryption.
This attack also highlights the risk of credential overload: as we busily turn on two-factor authentication (2FA) everywhere, more employees expect to receive access codes, making it easier for scammers to piggyback on the routine. The very tools designed to protect us—push notifications, verification codes—become new points of confusion and attack.

Risks the Industry Doesn’t Want to Talk About​

Let’s be brutally honest: the tech landscape loves shiny cybersecurity solutions, but the basics still get us. Awareness, verification, and healthy skepticism aren’t glamorous, but they’re the unsung heroes against 90% of these threats.
Enterprise IT often hesitates to restrict messaging apps (“But, collaboration!”), which leaves security gaps. Balancing productivity and protection is like herding cats while juggling flaming chainsaws—and vendors aren’t lining up to solve it.
There’s also an uncomfortable truth: as attacks get more personalized and less detectable by automation, IT pros will need more support—resources, budget, and the authority to say “no” now and then.
One can only hope that the ongoing deluge of scams spurs more realistic expectations from leadership: if you want bulletproof defenses, you can’t build them on a foundation of “just trust people more.”

The Lighter Side: Security Training Bingo​

If laughing about security fails is your coping mechanism (and let’s be honest, it’s the only way forward), here’s your new bingo card:

• Got a WhatsApp saying you won a Microsoft security sweepstake.
• Signal message from “European Official” ends with suspicious emoji.
• Colleague forwards an obviously phishy link “just to check if it’s real.”
• Manager proudly disables 2FA “because it’s just so annoying.”
• Training alerts you to “only trust communication from official-looking sources,” which, as it turns out, is everyone’s weak spot.

Congratulations, blackout. Unfortunately, the prize is more work.

Call to Action—Or, Your Least Favorite Security Reminder​

All jokes aside, the lesson is as familiar as a Windows update nag screen: slow down, ask questions, and never assume your apps are a safe zone. Scammers will use any channel popular enough to reach you—WhatsApp, Signal, today; TikTok and Discord, tomorrow.
And for IT teams running on caffeine fumes: now’s the time for another policy audit, another off-cycle training session, and maybe a quick team huddle to remind everyone that yes, even an emoji-laden message about world affairs can lead to real-world headaches.
Stay alert, and don’t be the next case study for why someone needs to explain credential sharing for the thousandth time. Your Microsoft credentials—and your peace of mind—deserve better.

Wrapping Up: Vigilance Over Virality​

Ultimately, scams like these succeed on simple human behaviors—trust, urgency, distraction. Technology helps, but no firewall can substitute for a pause before clicking, a healthy dose of skepticism, and the humility to double-check the unexpected.
So, next time WhatsApp pings with “urgent official business,” remember: you can’t patch human nature, but you can make it a little harder for hackers to have the last laugh.
And if nothing else, let’s all agree—before sharing that Microsoft code, check the sender, check your pulse, and for goodness’ sake, check with IT.
Because, as any seasoned sysadmin will tell you, the only thing scarier than a midnight Teams invite is the fallout from a compromised account… and nobody needs another ticket in the helpdesk queue for that.

---

Source: Mashable SEA WhatsApp, Signal scam leads to Microsoft account hacks. How to spot it.