TI Mindmap HUB
Threat Intelligence Report

Beyond the mailbox: Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion

๐Ÿ“… November 9, 2026 ๐Ÿ“ฐ www.sophos.com ๐Ÿ” 0 CVE(s) referenced

A vishing-enabled Microsoft 365 takeover used a durable token-backed identity to quietly map the tenant, steal nearly 100,000 SharePoint files, and pivot through federated SaaS apps to export ServiceNow user data.

vendor

Sign in to access the full report including:
detailed analysis, IOCs, MITRE ATT&CK mapping, and STIX bundle.

๐Ÿ” Sign In to Read Full Report

You'll need to accept our Terms of Service to access the platform.

๐Ÿ“Š Visual Mindmap
๐ŸŽฏ IOC Extraction
โš”๏ธ MITRE ATT&CK TTPs
๐Ÿ“ฆ STIX 2.1 Bundle