Belgium's CCB warns that attackers abused Microsoft Entra ID SMS first-factor sign-in (phone number and one-time code, no password) to compromise several Belgian organisations; turning off 'Use for sign-in' is the priority step
CCB: attackers signed in to Entra ID with an SMS code alone; turn off SMS first-factor sign-in
Defender actions
- In every Microsoft Entra tenant you run or manage for others, open the Authentication methods policy for SMS, list who is enabled and who actually signs in with SMS using the Authentication methods activity report, and turn off 'Use for sign-in' (labelled 'Enable first factor sign-in' in Microsoft's how-to) for everyone who has an alternative; where it must stay for frontline workers, restrict it to that group and monitor it, because the CCB reports successful attacks against it.
Analysis
The Belgian Centre for Cybersecurity (CCB) warned on 2026-11-10 that a trusted partner had observed successful attacks against multiple Belgian organisations in which attackers abused Microsoft Entra ID SMS as a first factor, the sign-in mode in which a phone number and a one-time code replace the password (CCB, 2026-11-10). The warning gives no victim count, sector, actor, date range or attack chain, and it does not say how the codes were obtained; its only statement on the factor itself is that SMS and voice can be phished, intercepted or SIM-swapped (CCB, 2026-11-10). No other source reports the Belgian attacks. Microsoft describes the method as designed for frontline workers, advises enabling it only for them, and says it is different from SMS as a multifactor method, which needs a username and password (Microsoft Learn, 2026-10-30). Microsoft is disabling first-factor sign-in in tenants with no such traffic in the previous 30 days (Microsoft Learn, 2026-10-30) and retires its own SMS and voice delivery on 2027-02-01 for all users except Global Administrators and external users, who follow on 2027-07-01; a customer-configured telephony provider can keep the methods working (Microsoft Learn, 2026-09-23).
Cited evidence
Check which users actually use SMS sign-in, give them an alternative and disable it as soon as possible
Look for successful SMS-based sign-ins, phone number or method changes, unusual locations or devices, and follow-on activity such as mailbox rules or app consents.
Sources3
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.