A New Government Alert Describes Phishing That Passes the MFA Check

Most phishing advice ends at the same place: train people to spot the fake. That advice is still worth giving, but it no longer finishes the job on its own, because a campaign described in a government alert published last week works even when the employee enters the correct multi-factor code.

On 28 October, the Canadian Centre for Cyber Security published Alert AL26-028, addressed to IT professionals and managers, describing an active help desk voice phishing campaign. The alert says the finance and legal sectors have been increasingly targeted since July 2026, and that October activity was concentrated on the legal sector.

The alert speaks to Canadian organizations, but what makes it worth a firm administrator’s attention in Los Angeles or Chicago is that the technique it documents has nothing to do with jurisdiction — it describes how a Microsoft 365 tenant gets taken over, and your firm’s tenant is likely configured much the same way as the ones in the alert. Keeping that tenant safe, secure, and reliable is work Innovative Computing Systems does every day, which means an alert like this one is ours to read closely on your behalf rather than yours to interpret between meetings.

What the alert actually describes

The call comes from someone claiming to be internal IT or the help desk, and it carries a deadline: an urgent passkey migration, an MFA enrolment, a required password change. It can arrive on an office line, a personal mobile, or as a Microsoft Teams call, and the caller ID can be spoofed to look right. If the employee says they want to verify independently, the caller sometimes just hangs up.

The employee is then sent to a sign-in page carrying the firm’s own branding, hosted on a newly registered domain that pairs an action word with an authentication term. The page is doesn’t collectedentials to use later. It passes the username, the password, and the multi-factor response straight through to the real identity provider in real time, which hands the attacker a live authenticated session. The employee approved a prompt that was genuinely theirs. That is why the alert describes this as bypassing conventional MFA.

What happens next is the part that turns an incident into a breach. According to the alert, the actor registers its own MFA method or device to keep access, deletes the password-reset and security notification emails that would have tipped anyone off, resets passwords on applications that sit outside single sign-on, and then uses scripts and Microsoft Graph to pull data out of Microsoft 365, SharePoint, OneDrive and connected SaaS applications. Extortion demands follow the data, not an encryption event.

The filings from the same week

Two new law firm entries appeared on the California Attorney General’s breach register in the same few days. Baker & McKenzie LLP filed on 27 October for incidents dated 14 and 17 August. Troutman Pepper Locke LLP filed on 28 October for an incident dated 7 August.

Baker McKenzie’s submitted notice is unusually direct about the cause: “On August 14 and 17, 2026, a threat actor socially engineered two of our users and obtained a limited number of … files.” The same notice states the firm has “no evidence that the unauthorized actor compromised any user credentials or additional user accounts.”

That last sentence matters, and it is why we are not going to tie these filings to the Canadian alert. Two users were deceived and files left the building without any credential being stolen at all. Different mechanism, same entry point: a person was convinced. The gap between an August incident and a late-October filing is also familiar ground, and it is the reason we treat notification readiness as something to prepare before it is needed rather than during.

CrowdStrike published its 2026 Legal Threat Landscape Report in the same week. These are the company’s own telemetry figures rather than independent research, so take them as CrowdStrike’s view: it reports that 455 legal entities were named on data leak sites, a 39% year-over-year rise, that 82% of the malicious activity it observed against the legal sector came from financially motivated actors, and that in one intrusion the attacker attempted to move data out four minutes after getting in. No amount of training closes a four-minute window; only the way the environment is built does, which is the same conclusion we reached about attacker tooling getting faster.

What we do about it

This is a preventable problem, and preventing it is our job, not your staff’s.

We move privileged and high-risk accounts onto phishing-resistant authentication — security keys, device-bound passkeys, platform authenticators — because a credential that is bound to a device cannot be relayed through a lookalike page, which means the attack described in AL26-028 fails at step two instead of succeeding quietly. We set and operate the verification standard for MFA resets, account recovery and new device enrolment, including for calls that reach our own service desk, so nobody at your firm is left deciding alone whether a caller is legitimate. We configure conditional access to require managed devices and to restrict sign-ins arriving through commercial VPNs, hosting providers and residential proxies, so a stolen session has nowhere to land. And we watch for the specific signals the alert names — new MFA registrations, scripted or unusually high-volume file access, security notifications being deleted — which is the same mailbox and access discipline we apply across the tenant.

When something does look wrong, we own the response: revoking active sessions and tokens, resetting credentials, removing MFA methods the attacker registered, reviewing mailbox and file activity, and preserving the identity provider and Microsoft 365 audit logs an investigation will need. Holding recovery capability out of reach is part of the same work.

Firms Innovative Computing Systems has worked with since 1989 do not get through weeks like this one because their people never make a mistake. They get through because the environment around the mistake was built to absorb it. You deserve better than spending your week reading government advisories and breach registers to work out whether your authentication design holds up, and you should not be the person who finds out it didn’t. That is ours to carry, and we’ve got your back.

If you want to know where your firm’s authentication currently stands against what AL26-028 describes, request a consultation and a Solutions Consultant will follow up to set up a conversation about your environment.