Kiran 
A wave of cloud intrusions traced back to a deceptively simple trick: a phone call about “updating your passkey” has quietly compromised enterprise identities since May 2026, according to new findings from Microsoft Security Research.
The campaign shows how attackers are weaponizing a security feature meant to kill phishing, turning passkey enrollment prompts into the opening move of a multi-stage cloud data-theft operation.
The intrusion begins far from any keyboard. A victim’s personal phone rings or buzzes with a text, supposedly from the company’s IT helpdesk, warning that their passkey, MFA, or SSO setup needs urgent action.
Fake Passkey Setup Calls Trigger Cloud Account Takeovers
A link often delivered via SMS to a personal device outside corporate telemetry leads to a convincing clone of a Microsoft sign-in page.
Critically, passkey enrollment is rarely the real goal. It’s a pretext to walk victims into adversary-in-the-middle (AiTM) phishing, which steals session tokens directly, or device-code phishing, where the victim unknowingly authorizes an attacker-controlled application.
Because the click often happens on an unmanaged personal phone, investigators may have zero endpoint evidence, leaving them to reconstruct the breach from sign-in logs, device-code events, and token activity alone.
In documented cases, a single AiTM sign-in to Microsoft’s Office Home application gave actors access to My Sign-Ins, My Apps, and Microsoft Approval Management within minutes, followed by enumeration of SharePoint and OneDrive files through the Graph API all within a session lasting roughly an hour.
Some intrusions instead relied on device-code token replay, bypassing MFA entirely without ever touching a browser cookie.
To convert temporary access into something durable, actors registered their own MFA method a new phone number, authenticator app, or software OTP token onto the compromised identity.
This single step lets an attacker satisfy future authentication challenges indefinitely, even after the original phishing session expires.
What follows is systematic: Microsoft Graph queries against /users, /groups, /directoryRoles, /sites, and /messages map out the entire tenant, its people, privileges, applications, and file repositories.
Individually, each API call looks routine. Strung together across a single identity in a short window, they form a clear reconnaissance-to-collection pipeline.
“What makes this campaign genuinely unsettling isn’t the phishing kit it’s the patience. Attackers throttle themselves to under 1,000 file or email accesses per hour specifically to look like normal employee behavior.
That’s not smash-and-grab crime; that’s an actor who has studied how SOC alerting thresholds work and is deliberately staying under them. Passkeys were supposed to make phishing obsolete instead, the branding alone has become the lure.”
Data theft, when it comes, is slow and deliberate, spanning hours to days rather than minutes. Microsoft observed the python-httpx user agent driving high-volume SharePoint and OneDrive downloads, alongside Exchange Online REST API calls harvesting email content, all paced to blend with ordinary enterprise traffic.
Microsoft Threat Intelligence links the initial-access tactics to Storm-3121 (feeding ShinyHunters and Falcon extortion operations) and Storm-3032, a Helix-branded offshoot of the BlackFile group.
Domains follow predictable patterns like companyname[.]add-passkey[.]com, often registered through Nicenic and operational within hours.
Organizations should enforce phishing-resistant MFA via Conditional Access, block device-code and authentication-transfer flows unless explicitly required, restrict unmanaged-device access to web-only sessions, and treat any helpdesk-initiated MFA reset as an event requiring rigorous identity verification and audit logging.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
