Canada warns of help-desk phone scams that relay MFA to break into Microsoft 365

Canada warns of help-desk phone scams that relay MFA to break into Microsoft 365

28 October 2026: The Canadian Centre for Cyber Security issued alert AL26-028 on 28 October about an ongoing voice phishing campaign against Canadian organisations. Callers pose as internal IT or the help desk and tell employees an urgent passkey migration, MFA enrolment or password change is needed. The campaign has focused on the legal sector this month and on finance and legal since July, and ends in data theft and extortion.

How the calls work

The calls reach employees on personal mobiles, office phones and Microsoft Teams, and may spoof the help desk's number. The employee is sent to a sign-in page branded with the organisation's name, on lookalike domains of the kind the alert lists as examples, such as names ending in onetimesso, registermymfa, sso or internal. The page sits between the victim and the real identity provider and relays the password and the MFA response as they are entered, which the Cyber Centre says bypasses conventional MFA. The lure domains rotate often. The centre has seen related infrastructure naming Canadian organisations since January 2026, and describes the tradecraft as consistent with a financially motivated actor.

What happens after sign-in

Once in, the attackers register their own MFA method, delete the notification emails about password resets and MFA changes, reset passwords for applications outside single sign-on, and use scripts and Microsoft Graph to pull data out of Microsoft 365, including SharePoint and OneDrive. Extortion demands follow.

The defences the centre recommends

• phishing-resistant MFA, meaning FIDO2 security keys, device-bound passkeys or platform authenticators, starting with privileged users;
• conditional access that requires managed devices and blocks sign-ins from commercial VPNs, hosting providers and residential proxies;
• stronger identity checks before the help desk resets MFA or enrols a device, and shorter sessions;
• monitoring for new MFA registrations, scripted bulk access to Microsoft 365 files, deletion of security notification emails and newly registered lookalike domains;
• restricting external contact in Teams, Webex and Slack.

Incidents can be reported through the centre's My Cyber Portal.

Why the passkey lure matters

The lure turns good advice against its targets: many organisations really are moving staff to passkeys, so a call about a "passkey migration" sounds plausible. The defence is procedural as much as technical. Employees need to know how a real enrolment will reach them, and help desks need a verification step for MFA resets that a caller cannot talk their way through. Law and accounting firms with Microsoft 365 tenants that still allow SMS or app push as the only second factor for partners are the most exposed.

Related on TrustList:

• Microsoft Authenticator for Android let any app pose as Teams and get work tokens

Sources

• Canadian Centre for Cyber Security: AL26-028, Ongoing help desk voice phishing campaign targeting Canadian organizations (28 October 2026), 28 October 2026