Microsoft details passkey-themed phishing that led to bulk theft of cloud data
Attackers posing as IT help desks used passkey setup as a pretext, a reminder that enrolment and recovery flows deserve the same scrutiny as the login itself.
Microsoft has published details of two campaigns in which operators abused third-party email infrastructure and phone-based social engineering to defraud businesses and breach cloud tenants, according to a report by The Hacker News on 13 September 2026.
The first campaign ran from 3 to 5 August 2026 and involved more than a million scam emails. The messages impersonated chief executives and asked for ACH transfers to pay for fictitious ServiceNow subscriptions. Targets were mainly organisations in the United States across IT services, consumer goods, real estate and discrete manufacturing. Microsoft said the senders used generative AI to produce tailored templates and fabricated invoice threads with forged approval messages.
The second campaign, observed since May 2026, used passkeys as a pretext. Operators contacted employees on personal phone numbers, claimed to be from the IT help desk, and pressed them to update passkey, MFA or SSO settings immediately. Victims were sent by SMS to counterfeit Microsoft sign-in pages where adversary-in-the-middle or device-code authentication flows captured their sessions. Domains seen included passkeyhelpdesk[.]com, secure-passkey[.]com and setupmypasskey[.]com.
Once inside, the intruders registered their own MFA methods, ran extensive reconnaissance through the Microsoft Graph API to enumerate users, groups and permissions, harvested mailbox contents, and downloaded large volumes of data from SharePoint Online, OneDrive and Exchange Online over hours to days. Microsoft attributed the activity to groups it tracks as Storm-3121 and Storm-3032, with links to the ShinyHunters, Falcon and Helix extortion brands.
Why it matters
Passkeys were designed to resist phishing, and this campaign shows attackers routing around the technology by targeting enrolment and recovery rather than the credential itself. The sequence of Graph API queries and bulk downloads after login indicates that detection increasingly depends on recognising behavioural patterns rather than single events. Pairing AI-generated lures with high-volume delivery also lowers the cost of convincing fraud. Identity teams should expect the help-desk pretext to become a standard part of the intrusion toolkit.
Passkeys were designed to resist phishing, and this campaign shows attackers routing around the technology by targeting enrolment and recovery rather than the credential itself.
Help-desk pretext
A call or message to an employee's personal number urges an immediate passkey, MFA or SSO update.
SMS to counterfeit sign-in
The victim is sent to a look-alike Microsoft page such as passkeyhelpdesk[.]com.
Session captured
An adversary-in-the-middle proxy or device-code flow captures a valid session.
Attacker adds own MFA
New phone numbers, authenticator apps or OTP tokens are registered for persistence.
Recon and bulk download
Graph API enumeration, then large downloads from SharePoint, OneDrive and Exchange over hours to days.
What you can learn from this
- Phishing-resistant credentials protect the login, not the enrolment. A passkey is a public-private key pair bound to the exact website origin that created it, so a counterfeit page cannot trigger a valid signature from it. Adding a new passkey or MFA method, however, is an ordinary authenticated action that any hijacked session can perform. Attackers therefore aim at the moment of setup, when a user expects to be interacting with security prompts and is least likely to question them. Recovery codes and SMS fallbacks deserve the same suspicion, since they are weaker paths into the same account.
- Adversary-in-the-middle kits steal sessions rather than passwords. An AitM proxy sits between the victim and the genuine sign-in page, relaying every request and response in both directions. The victim completes a real login, including their MFA step, and the proxy quietly copies the session cookie or token that comes back. Because that token is what the cloud service checks on every later request, the attacker can use it without ever learning the password.
- Device-code flow is a legitimate protocol that phishes unusually well. OAuth device authorisation exists for equipment without a keyboard, such as a TV or a command-line tool: the device shows a short code, the user types it into a trusted browser, and the device then receives tokens. An attacker can start that flow on their own machine and talk the user into entering the code, which hands the attacker's device a valid session. The design behaves this way because the protocol deliberately separates where the code is shown from where consent is granted.
- Persistence usually means registering new authenticators. Once an intruder adds a phone number, authenticator app or OTP token to an account, they have a durable route back in that survives a password reset. This is why identity teams treat authentication-method changes as a high-value alert and why a password reset alone is an incomplete response. Reviewing and pruning registered methods is part of recovering an account, not an optional extra.
- Directory reconnaissance looks like administration when viewed one call at a time. Microsoft Graph is the same interface that administrators and business applications use to list users, groups, permissions and files. Any single request is unremarkable, which is precisely why it is attractive to an intruder. A rapid enumeration of the directory followed by bulk downloads from SharePoint is the pattern that gives the activity away, so detection has to correlate events across time and across services.
We teach this
How to use this in practice
- Audit the authentication methods on your own accounts. Open the security settings of your Microsoft, Google or workplace identity account and list every registered method: phones, authenticator apps, passkeys, recovery emails and hardware keys. Remove anything you cannot name and note the date you added each remaining item. Done looks like a short list where every entry has an owner and a reason, plus a calendar reminder to repeat the check every quarter.
- Check whether device-code flow is even needed in a tenant you administer. In Microsoft Entra, Conditional Access includes an authentication flows condition that can block device code authorisation for users who never use headless devices. Create the policy in report-only mode first and watch the sign-in logs for a week. Block legacy authentication protocols in the same pass, since they bypass MFA entirely. Done looks like a report showing zero legitimate device-code sign-ins, followed by switching the policy to enforced for that group.
- Draw the adversary-in-the-middle sequence on one page. Boxes for the victim, the proxy site, the real sign-in page and the cloud service, with arrows for the credential, the MFA prompt and the returned session token. Mark in one colour where a passkey stops the attack through origin binding, and in another where a recovery or enrolment step bypasses it. Done looks like a diagram a colleague can follow without you explaining it.
- Write a three-line help-desk rule for yourself and share it. Line one: never act on an inbound call or text about MFA or passkeys. Line two: hang up and call the support number published on the intranet or the vendor's site. Line three: treat any SMS link to a sign-in page as invalid regardless of who sent it. Repeat the rule to family members who bank online, because the same script works on personal accounts. Done looks like the rule pinned where you work and sent to one person who would otherwise take that call.
Sources
- Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data — The Hacker News
Our reporting is an original summary; full coverage is at the links above.
Don't just read about it — build it.
Square 1 teaches the skills behind the headlines, with every line of your work graded by AI. Find your starting point in 3 minutes.
Get your free skill report