Researchers Warn: Passkey Phishing Attacks Are Leading to Cloud Account Takeovers
In an active social engineering campaign, attackers are impersonating IT help desks and using fake passkey setup requests to compromise employee identities and gain access to enterprise cloud data.
In a recent blog post, Microsoft Security Research said it has observed the activity since May 2026 across multiple compromised accounts.
The attacks have included unusual sign-ins, attacker-added authentication methods, high-volume Microsoft Graph activity, SharePoint and OneDrive downloads, and e-mail collection through REST APIs.
The attacks often begin with a phone call or message sent to an employee's personal phone.
The attacker poses as someone from the organization's IT help desk and tells the victim that a passkey, multifactor authentication (MFA), or single sign-on configuration needs to be updated to avoid disruption.
Victims are then directed to a website designed to resemble a legitimate Microsoft sign-in experience.
Microsoft has also observed links being delivered through SMS messages and, in some cases, through Microsoft Teams messages sent from already compromised employee accounts.
Despite the passkey-themed approach, the tech company stressed that enrolling a passkey is generally not the attacker's actual objective.
Instead, the request provides a pretext for directing victims through adversary-in-the-middle phishing or device-code authentication.
An adversary-in-the-middle attack can capture credentials and session tokens, while device-code phishing can trick a victim into authorizing access for an attacker-controlled client.
In one attack investigated by the tech giant, an anomalous sign-in from an unmanaged device was followed by access to identity and application management services.
The attacker then used SharePoint Online and OneDrive to enumerate sensitive files, primarily through Microsoft Graph. The sessions persisted for roughly an hour while the attacker searched for sensitive files and internal applications.
Gaining initial access isn't necessarily the end of the identity attack.
Microsoft found attackers registering new authentication methods, including phone numbers, authenticator apps, and software-based one-time password tokens, under their control.
That gives the attacker another way to satisfy future authentication challenges and helps turn an initial compromise into a more persistent foothold.
From there, attackers have used Microsoft Graph to map users, groups, permissions, applications, and accessible content across compromised tenants.
The firm says the activity can eventually progress to accessing mail, files, attachments, and other document content.
Microsoft attributed initial access activity associated with the campaign to multiple threat actors, including Storm-3121 and Storm-3032.
Storm-3121 conducts initial access activity that can lead to ShinyHunters and Falcon extortion, while Storm-3032 represents actors that split from the BlackFile group and now operate under the Helix extortion banner.
For administrators, Microsoft recommends enforcing phishing-resistant MFA such as FIDO2 passkeys and Windows Hello for Business through Conditional Access.
Organizations should also consider blocking device-code and authentication-transfer flows where they aren't required and investigate unusual sign-ins followed by new authentication methods, Graph reconnaissance, and abnormal SharePoint, OneDrive, or mailbox activity.
The campaign highlights an important distinction for organizations adopting passkeys: The attackers aren't necessarily defeating the technology. They're convincing employees that they need help setting it up, then using that trust to compromise their identities.
For more information, read the Microsoft blog post.