24/7 M365 – All Ransom, No Ware

Between August and September 2026 Binary Defense investigated two Microsoft 365 tenant compromises where attackers used voice‑phishing and AiTM reverse‑proxy pages to capture credentials and live MFA approvals, registered their own authenticators for persistence, scripted large‑scale file collection through the Microsoft Graph API (logged as FileAccessed to evade DLP), deleted security notifications, and sent 72‑hour extortion demands from within victims' tenants—demonstrating how extortion can achieve ransomware‑scale outcomes without ever deploying malware or encryption, and providing TTPs, IOCs, detection guidance, and mitigations.