On September 9, 2026, Microsoft Security Research described a social engineering campaign that uses passkeys as a pretext to take over Microsoft 365 accounts. Observed since May 2026, it often starts with a phone call or text message to an employee’s personal phone from a fake IT help desk. The irony: no passkey is ever enrolled. Talk of this anti-phishing technology is used to steer victims to an adversary-in-the-middle phishing page or a device code authorization, before data is quietly exfiltrated from SharePoint, OneDrive and Exchange.
- The lure: an “urgent” passkey, MFA or SSO update, announced by a fake help desk over the phone or by SMS, sometimes relayed through Teams from already compromised accounts.
- Two main techniques: adversary-in-the-middle (AiTM) phishing that captures credentials and session tokens, and device code phishing that issues a token to an attacker-controlled client.
- After access: registration of an attacker-controlled MFA method, automated reconnaissance through Microsoft Graph, then slow collection of documents and email.
- Microsoft attributes initial access to several actors, including Storm-3121 (linked to ShinyHunters and Falcon extortion) and Storm-3032 (split from BlackFile, now operating under the Helix banner).
What Microsoft observed
Microsoft is tracking active cloud intrusions across multiple accounts. Attackers start by researching employees and the organization chart on social and professional platforms. They then reach out to the target, often on a personal phone, posing as the internal help desk and invoking urgency: a passkey, MFA or SSO configuration must be updated to avoid disruption.
Targeting personal phones is deliberate. On an unmanaged device, the exchange never shows up in corporate telemetry. According to Microsoft, the employee’s recollection is sometimes the only early evidence of the attack.
Purpose-built domain infrastructure
Attackers register generic domains themed around passkeys, SSO or key sync, and place the target organization’s name in a subdomain (for example contoso[.]add-passkey[.]com). Several domains are used per organization, often live within hours. Published examples include passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, oktasession[.]com and integratedsso[.]com.
Technical analysis
Three paths into the account
| Technique | How it works | What it bypasses |
|---|---|---|
| AiTM phishing | Fake Microsoft sign-in page relaying traffic between the victim and the real service | Non-phishing-resistant MFA: credentials and session tokens are captured |
| Device code | The victim enters a code on the genuine Microsoft page, which issues a token to an attacker-controlled client | No cookie theft needed; the replayed token bypasses MFA |
| Pre-registered MFA method | Sign-in with compromised credentials, approved through an OTP method registered days earlier | MFA itself, hijacked by the attacker |
In one investigated sequence, the initial sign-in to OfficeHome from an unmanaged context was followed within two to four minutes by visits to My Apps, My Profile and My Sign-Ins, then, within a quarter of an hour, by access to SharePoint Online, Outlook Web, Azure Virtual Desktop and an internal business application. The session stayed active for about an hour.
Persistence through MFA registration
Once inside, the attacker adds an authentication method they control: a phone number, an authenticator app or a software OTP token. Microsoft notes that this persistence does not survive a full credential and session reset, but becomes durable when combined with stolen tokens, unrevoked sessions or valid credentials.
Graph reconnaissance and low-and-slow exfiltration
The attacker uses a Node.js automation tool built on Microsoft Graph, with different IP addresses for authentication, reconnaissance and exfiltration. Reconnaissance covers the tenant profile, users and groups, directory roles and authentication methods, applications and OAuth consents, SharePoint sites and OneDrive drives, and mailboxes.
Collection is deliberately measured: running for hours or days, with fewer than 1,000 files or emails accessed per hour, to blend in with normal use. Microsoft observed high volumes of FileAccessed and FileDownloaded events, sometimes with the python-httpx user agent, REST API access to Exchange Online content, and the use of anonymous proxies.
Why it matters for your organization
Organizations are rolling out passkeys to defend against phishing. Attackers are turning that very project against them: a “passkey update” request sounds legitimate precisely because such a project is under way. As long as weaker MFA methods or the device code flow remain allowed, moving to passkeys does not protect accounts.
The second lesson is about detection. An attacker exfiltrating fewer than 1,000 items per hour from rotating infrastructure will not trip classic volume thresholds. Only correlating an unusual sign-in, a new MFA registration, Graph reconnaissance and bulk data access can reconstruct the intrusion.
MITRE ATT&CK mapping
Mapping provided by Microsoft in its report (excerpt):
| Technique | Observed behavior |
|---|---|
| T1591 — Gather Victim Org Information | Research on employees and organization chart |
| T1598.003 — Spearphishing Link | Links to fake pages sent by SMS or messaging |
| T1583.001 — Domains | Passkey-, SSO- and key-sync-themed domains |
| T1078.004 — Cloud Accounts | Use of compromised Microsoft 365 accounts |
| T1556.006 — Multi-Factor Authentication | Registration of attacker-controlled MFA methods |
| T1087.004 / T1069.003 — Cloud Account / Cloud Groups | Enumeration of users, groups and roles via Graph |
| T1530 / T1114 / T1213 — Collection | Collection from SharePoint, OneDrive and Exchange |
| T1567 — Exfiltration Over Web Service | Exfiltration through web services |
Recommendations
These recommendations build on the priorities published by Microsoft, complemented by our field experience.
- ImmediateBlock the device code flow
Use Entra Conditional Access to block device code and authentication transfer flows, unless there is an explicit, documented business need.
- ImmediateAudit recently registered MFA methods
Look for new methods (phone, authenticator, software OTP) tied to risky or unusual sign-ins. If in doubt: revoke sessions and refresh tokens, reset credentials, remove attacker-added methods and mailbox rules, then require secure re-registration.
- ImmediateLock down help desk procedures
Verify identity rigorously before any credential or MFA reset, alert on every reset, and give employees an official channel to verify any request that claims to come from IT support.
- Short termEnforce phishing-resistant MFA
Require FIDO2/passkeys or Windows Hello for Business through Conditional Access, and protect security info registration (managed device or named location, block under high sign-in risk).
- Short termRestrict data access from unmanaged devices
Require a compliant device for Exchange, SharePoint and privileged Graph applications; limit other devices to web-only access with no download or sync, and disable anonymous sharing links.
- Medium termCorrelate identity and data access
Enable Microsoft Graph activity logs and mailbox auditing, and build detections that chain unusual sign-ins, MFA registration, Graph enumeration and bulk access, rather than relying on isolated thresholds.
- Medium termTrain users on MFA-focused vishing
Prepare users for calls and texts from fake IT support mentioning passkeys, MFA or SSO, especially during rollout projects.
This campaign shows that identity security does not end with choosing an authentication method: legacy flows, help desk procedures and post-sign-in monitoring matter as much as the passkey itself.
Our SOC, Detection & Response service correlates identity and data access signals to detect these low-and-slow intrusions. Our Training & Awareness programs prepare your staff and help desk for phone-based social engineering.
- Passkey-themed social engineering leads to identity and cloud compromiseMicrosoft Security Blog — Microsoft Security Research — September 9, 2026
- Passkey-themed phishing attacks lead to Microsoft 365 data theftBleepingComputer — Lawrence Abrams — September 11, 2026
- Original report on passkey phishingThe Hacker News — September 2026
- MITRE ATT&CK® — Enterprise MatrixMITRE Corporation
