Two phishing tricks slipping past multifactor authentication, and what your team should do about them.

Our team has handled a wave of these two phishing attempts in local inboxes over the past few weeks. Both are built to get past multi-factor authentication, not just a weak password. Here's how each one works and what to tell your staff today.

1. The Fake Voicemail That Steals Your Microsoft Password

The email looks routine. It says you missed a call and includes a button or attachment to "listen" to the voicemail. The file name often mimics an audio clip, something like a music note next to "New-Voicemail.mp3."

Click through, and you land on a page built to look exactly like the Microsoft 365 sign-in screen. It asks for your email, your password, and then your MFA approval, a push notification or a six-digit code.

This is where it gets dangerous. The attacker isn't just collecting your password for later. The fake page sits between you and the real Microsoft server in real time. Security researchers call this an adversary-in-the-middle, or AiTM, attack. When you approve the MFA prompt, the attacker captures the live session token behind it. Your MFA worked exactly as designed, and the attacker got in anyway.

This isn't a rare or isolated campaign. Microsoft's security team blocked more than 13 million malicious emails tied to one voicemail-themed phishing kit, known as Tycoon2FA, in a single month in late 2025. That surge has continued through 2026. In April 2026, Microsoft tracked a related AiTM campaign that hit more than 35,000 users. It spanned 13,000 organizations in 26 countries. Ninety-two percent of the targets were in the United States.

2. The Email That Looks Like It Came from You

This one shows up in your inbox with your own name and address in the From field. It often threatens to release embarrassing photos or claims to have hacked your webcam, then demands payment, usually in cryptocurrency.

Here's the good news: an email "from you" almost never means your account was hacked. Forging the From field, known as spoofing, is simple and doesn't require access to anything. Scammers sometimes include an old password from a past data breach as scare tactic "proof." It isn't proof of anything current.

A newer, more convincing version of this trick showed up in Microsoft security research published in January 2026. Attackers are exploiting complex mail routing paths and gaps in a company's spoof protections. Weak or missing SPF, DKIM, and DMARC records are the usual gap. That lets a message pass authentication check and appear genuinely internal. It can land in an inbox looking like it came from a colleague, or even the recipient, without tripping the usual external-sender warning banner.

That combination, a message that looks internal and passes technical authentication, is exactly what makes it effective against employees trained to distrust only outside senders.

What to Do Now

These aren't reasons to panic. They're reasons to tighten a few specific controls. Here's where to start.

• Tell staff never to click links or open attachments in voicemail, fax, or missed-call notification emails. Log into Microsoft 365 through a saved bookmark instead.
• Move to phishing-resistant MFA, for anyone with access to financial systems or sensitive data. Advanced identity-focused cyberattacks like AiTM (Adversary-in-the-Middle) defeat SMS codes and one-tap push approvals.
• Turn on Conditional Access policies that block sign-ins from unfamiliar countries or unmanaged devices.
• Have your IT partner audit your SPF, DKIM, and DMARC records. Set the DMARC policy to quarantine or reject failures, not just monitor them.
• Train employees to check the full sender address, not just the display name, even on messages that look internal.
• Treat any email that appears to come from your own address as spam. Don't reply, don't pay, don't click. Report it and move on.
• Turn on mailbox audit logging and sign-in alerts so unusual activity gets flagged fast, not discovered weeks later.
• Put a same-day password reset and session revocation process in place for anyone who reports a suspicious sign-in prompt.

Both of these tactics count on one thing: an employee treating a familiar-looking email as safe. A quick policy review and the right MFA setup close that gap fast.

If you'd like us to review your Conditional Access policies, test your MFA configuration, or audit your email authentication records, reach out. We're glad to run a quick assessment for your organization.