Passkey Help-Desk Vishing: Rogue MFA Registration to SharePoint Data Theft

The case opened on an identity alert for the employee named in the briefing. Open the identity events in the panel and lay out three weeks of this employee's logons: the places the managed laptop, the enrolled phone and the usual networks come from. On the afternoon of 29 September a web logon for the same employee arrived from a place that history does not contain. Submit the IP it came from.

The briefing says a second way of approving prompts was added to the same employee on that afternoon, and the ticket note says it was a passkey done with IT on the line. The identity events in the panel keep the record that added it, written by the platform itself rather than by the employee. Find that record and submit the tag the newly added entry carries.

While the caller was still on the line, the employee typed the address the caller read out into the browser on his laptop. The web and name-resolution telemetry hold what that address was and where it led, a couple of minutes before the outside logon from the first task. Submit the full host name he typed.

Two identities pulled far more items than usual out of the libraries on the afternoon of 29 September, and both tripped the same detection. The second case landed that evening on tomas.ferreira; the first had been raised on a colleague and settled hours earlier. Submit where the settled case's closing comment says the colleague's items were being moved to, written as the comment writes it.

Return to the identity from the first task. Between that afternoon and the following morning, dozens of items left its libraries and its own storage, retrieved from the two outside origins rather than from the laptop. Identify the software that did the retrieving and submit the agent string exactly as the records carry it.

Before seven the next morning the same identity logged in once more from outside, from a second origin, and the second check was cleared by typing a one-time value rather than by approving a push. Submit the name of that check as the record labels it, not its longer description, exactly as written.

The libraries were not the only thing read from outside. Over the afternoon of 29 September and again the next morning, the identity's mailbox was read through the Exchange API from the two outside origins, in batches rather than message by message. Privacy and legal need the size of the exposure before they decide on notification. Submit the total number of mailbox items those reads covered across both days, as a whole number.