Belgium CCB: attackers are abusing SMS sign-in on Entra ID, switch it off

Belgium CCB: attackers are abusing SMS sign-in on Entra ID, switch it off

10 November 2026: The Centre for Cybersecurity Belgium (CCB) has warned that several Belgian organisations were compromised by attackers who signed in to Microsoft accounts with nothing more than a phone number and a one-time text message code. The national authority asks every organisation that allows SMS as a first sign-in factor to stop doing so as soon as it has found out who depends on it.

What the attackers used

According to the CCB, a trusted partner saw successful attacks against multiple Belgian organisations in which the attackers abused Microsoft authentication set up with SMS as the first factor: the user enters a phone number, receives a code and is signed in without a password. The CCB classes the problem as a misconfiguration rather than a software flaw, so there is no patch to install. It names Microsoft Entra ID (formerly Azure AD), covering SMS and voice for sign-in, for multi-factor authentication and for self-service password reset, and also any other identity platform or portal that accepts SMS or voice as a first factor.

The centre's reasoning is that text and voice codes can be phished, intercepted or moved to another SIM card through a SIM swap, whether they are the first factor or the second. It adds that Microsoft will stop delivering SMS and voice codes in Entra ID from 1 February 2027 for most users and from 1 July 2027 for Global Administrators and external users, so the method has a limited life in any case.

The order the CCB recommends

The advice is not to switch SMS and voice off in one go, because users can be locked out or left with a password alone. The CCB sets out these steps:

• Assess first. Find which users, groups, applications and processes rely on SMS or voice, including break-glass accounts, frontline and shared-device workers, external users and third-party systems. For Entra ID it points to the SMS and voice usage analyzer for policy scope and the Authentication methods activity report for actual use.
• Treat SMS as a first factor as the priority. Check who actually signs in this way, give them another method and turn off "Use for sign-in" under Authentication methods, SMS. Until then, limit it to the smallest group possible and watch it closely.
• Clear privileged accounts. Remove SMS and voice from admin accounts once each has a working phishing-resistant method.
• Roll out alternatives with a pilot. Passkeys and FIDO2 keys are the methods named, tested first on a pilot group, together with password reset, recovery and help-desk procedures.
• Phase out and tell users. Warn users in advance, then remove SMS and voice from MFA and password reset in stages while watching for lockouts.

Looking for signs of a break-in

Where SMS sign-in was switched on, the CCB asks organisations to review sign-in and audit logs as far back as retention allows. The signs it lists are successful sign-ins through SMS, changes to phone numbers or authentication methods, unfamiliar locations or devices, and follow-on activity such as new mailbox rules or application consents. Incidents should be reported to the CCB through its incident form, and the centre reminds entities covered by NIS2 of their notification deadlines.

The warning does not name the organisations affected, the sectors they are in or how many accounts were taken over.

Related on TrustList:

• Entra ID retires Microsoft's SMS and voice codes for password reset
• Entra ID adds passkeys for guest users, on by default
• Norway's security authority raises national cyber risk level to high

Sources

• Centre for Cybersecurity Belgium: Warning, multiple Belgian organisations compromised through SMS sign-in, disable SMS as a first factor now, 10 November 2026, 10 November 2026