Threat actors exploit BYOD voice calls to breach Microsoft 365, target corporate data

Threat actors are using Microsoft's Graph API to identify high-value targets, then handing access to extortion groups like ShinyHunters. The attack vector exploits BYOD voice calling to reach Microsoft 365 and corporate data. This marks a novel intrusion path, shifting from email to voice, and poses a significant risk to enterprise security.