{"id":9458,"date":"2026-09-11T09:51:37","date_gmt":"2026-09-11T09:51:37","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9458"},"modified":"2026-09-11T09:51:37","modified_gmt":"2026-09-11T09:51:37","slug":"attackers-use-passkey-themed-scams-to-hijack-microsoft-365-accounts","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9458","title":{"rendered":"Attackers use passkey-themed scams to hijack Microsoft 365 accounts"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Attackers are using passkey-themed social engineering to trick employees into giving them access to their Microsoft accounts.<\/p>\n

Microsoft Security Research said it has been tracking active cloud intrusions since May in which attackers impersonated IT helpdesk staff, told employees they needed to update or enroll a passkey<\/a>, and then took them to adversary-in-the-middle (AiTM<\/a>) phishing pages or Microsoft device-code authentication flows.<\/p>\n

The campaign ultimately gave attackers access to compromised cloud identities, allowing them to register their own authentication methods, map the victim\u2019s Microsoft 365 environment, and access cloud-hosted files and emails.<\/p>\n

\u201cThe passkey in this campaign is the lure, not the weakness,\u201d said Jon Baker<\/a>, VP of Threat-Informed Defense at AttackIQ. \u201cThe MFA that got bypassed was phishable. Real passkeys would have stopped it.\u201d<\/p>\n

<\/a>Identity compromised through a helpdesk call<\/h2>\n

The attacks commonly begin with a phone call or message to an employee\u2019s personal mobile number from someone claiming to be from the organization\u2019s IT helpdesk. The attacker tells the employee that a passkey, MFA<\/a> or SSO configuration needs to be updated immediately to avoid disruption.<\/p>\n

The victim is then redirected to a website that resembles a Microsoft sign-in page. In AiTM attacks, the adversary can capture credentials and session tokens. In device-code attacks, the victim is instead told to enter a code on a legitimate Microsoft authentication page, authorizing an attacker-controlled client.<\/p>\n

Microsoft says the initial interaction can leave little endpoint evidence, particularly when the victim opens the phishing link on a personal device that is not managed by Microsoft Defender for Endpoint.<\/p>\n

In some cases, attackers also used already-compromised accounts to send passkey-themed messages via Microsoft Teams, making the requests appear to come from a trusted colleague.<\/p>\n

The campaign is not limited to a single attack pattern. Microsoft also observed cases in which attackers used credentials and MFA methods that had apparently been registered days earlier, suggesting that MFA persistence had already been established.<\/p>\n

<\/a>Attackers registered their own authentication methods<\/h2>\n

Once an identity was compromised, Microsoft observed attackers registering authentication methods under their control, including phone numbers, authenticator applications, and software-based OTP tokens. This gave them a way to satisfy future MFA challenges without the legitimate user.<\/p>\n

Attackers then used Microsoft Graph to enumerate users, groups, roles, authentication methods, applications, and cloud resources. They subsequently moved into SharePoint and OneDrive to locate and access files, while some intrusions involved Exchange Online and REST API-based access to email.<\/p>\n

\u201cThe actor registers their own authenticator method, maps the tenant through Microsoft Graph, and pulls files and mail at a pace that reads like a busy employee,\u201d Baker said. \u201cNone of those calls is suspicious on its own. The sequence is.\u201d<\/p>\n

Signs of automation were observed in some cases, including the \u201cpython-httpx\u201d user agent associated with high-volume SharePoint<\/a> and OneDrive activity. Attackers also maintained a controlled pace, with fewer than 1000 files or emails accessed in an hour, potentially allowing the activity to blend into normal enterprise behavior. <\/p>\n

Microsoft has recommended correlating unusual sign-ins with new authentication method registrations, Graph reconnaissance, and abnormal SharePoint, OneDrive, and Exchange activity. It also advised enforcing phishing-resistant MFA via Conditional Access and blocking device-code and authentication-transfer flows where there is no legitimate business need.<\/p>\n

\n<\/p><\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Attackers are using passkey-themed social engineering to trick employees into giving them access to their Microsoft accounts. Microsoft Security Research said it has been tracking active cloud intrusions since May in which attackers impersonated IT helpdesk staff, told employees they needed to update or enroll a passkey, and then took them to adversary-in-the-middle (AiTM) phishing […]<\/p>\n","protected":false},"author":0,"featured_media":9459,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9458","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9458"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9458"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9458\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9459"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9458"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9458"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9458"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}