Researchers Warn: Passkey Phishing Attacks Are Leading to Cloud Account Takeovers

The landscape of enterprise cybersecurity is undergoing a precarious shift as threat actors evolve their social engineering playbooks to exploit the very technologies designed to secure them. Microsoft Security Research has issued an urgent warning regarding an ongoing, sophisticated campaign that leverages the transition to passkeys as a deceptive pretext for cloud account takeovers. By masquerading as authoritative IT help desk personnel, attackers are manipulating employees into bypassing security protocols, ultimately gaining deep access to sensitive corporate environments, including SharePoint, OneDrive, and Microsoft Graph resources.

The Anatomy of the Deception

The campaign, which Microsoft has been tracking since May 2026, represents a tactical departure from traditional "spray-and-pray" phishing attempts. Instead of relying on generic credential harvesting pages, attackers are employing high-touch social engineering. The process typically begins with an unsolicited communication—often a phone call or a text message sent to an employee’s personal mobile device.

In these interactions, the threat actor poses as a member of the organization’s internal IT support team. The narrative is engineered to create a sense of urgency: the victim is told that their multifactor authentication (MFA) settings, passkey configuration, or single sign-on (SSO) credentials must be updated immediately to prevent a service disruption or to comply with new organizational security policies. By exploiting the inherent trust between an employee and their IT department, the attacker effectively lowers the victim’s guard.

Once the victim is primed, they are directed to a malicious portal meticulously designed to mimic a legitimate Microsoft sign-in interface. While the pretext involves setting up a passkey, the underlying objective is rarely the actual enrollment of a passkey. Rather, the attackers utilize this conversation as a vehicle to execute more potent attack vectors, specifically Adversary-in-the-Middle (AitM) phishing or device-code authentication manipulation.

Tactical Execution: Beyond Simple Credential Theft

The technical sophistication of this campaign lies in how it subverts modern authentication flows. In an AitM scenario, the malicious site functions as a transparent proxy, capturing not just the username and password but also the session token. This allows the attacker to bypass standard MFA prompts, effectively assuming the user’s identity without needing the victim’s second factor.

Simultaneously, the use of device-code phishing presents a unique challenge to enterprise security teams. In this workflow, the attacker tricks the user into authorizing a device code on a malicious client they control. By entering the code provided by the attacker into the legitimate Microsoft portal, the user inadvertently grants the attacker’s application access to their cloud resources. This action effectively hands over the keys to the kingdom, allowing the attacker to establish a persistent, authenticated session.

Chronology of the Threat

Microsoft’s investigation has identified the campaign as an ongoing, multi-tenant threat. Since the identification of the activity in May 2026, researchers have observed a pattern of operations involving several identified threat groups, most notably Storm-3121 and Storm-3032.

• Initial Engagement: The cycle begins with the social engineering pretext, often involving spoofed SMS or, in instances of cross-tenant compromise, internal Microsoft Teams messages sent from previously compromised employee accounts within the same supply chain or partner network.
• Access Escalation: Once initial access is gained, the attackers perform rapid reconnaissance. They utilize Microsoft Graph to map the organization’s structure, identifying user groups, application permissions, and sensitive data repositories.
• Persistence Mechanisms: A critical stage of the attack is the registration of new, attacker-controlled authentication methods. By adding their own phone numbers, authenticator apps, or software-based TOTP tokens to the compromised account, the threat actors ensure they can bypass subsequent security challenges even if the user changes their password.
• Data Exfiltration: Once a foothold is established, the attackers pivot to SharePoint Online and OneDrive. During the documented hour-long sessions, attackers have been observed systematically enumerating and downloading high-value files, documents, and internal emails via REST APIs.

The Role of Threat Actors

Microsoft has attributed significant portions of this activity to specialized cybercriminal entities. Storm-3121 is characterized as a "provider" of initial access, creating the pathways that are later leveraged by actors associated with the ShinyHunters and Falcon extortion syndicates. Storm-3032, a group that splintered from the BlackFile operation, has also integrated these passkey-themed phishing tactics into their broader Helix extortion framework. These groups are highly organized, operating with a level of operational security that suggests a clear division of labor between those who acquire the access and those who monetize the stolen data.

Broader Implications for Cloud Security

The rise of these attacks highlights a growing "security gap" created by the transition to modern authentication methods. While FIDO2-based passkeys are fundamentally more secure than SMS-based or legacy MFA, the human element remains the primary point of failure. Attackers are not breaking the technology; they are weaponizing the confusion that often accompanies organizational IT changes.

This campaign serves as a sobering reminder that as technical defenses improve, threat actors will inevitably shift their focus to the psychological manipulation of users. Organizations that have recently mandated passkey adoption are particularly vulnerable, as employees are already conditioned to expect requests for authentication updates.

Mitigation and Strategic Recommendations

Microsoft and independent security experts emphasize that the solution to this threat is not to abandon passkeys, but to harden the environment around them. To defend against this specific class of social engineering, organizations should implement the following security measures:

1. Phishing-Resistant MFA: Administrators are urged to strictly enforce phishing-resistant authentication, such as FIDO2 passkeys and Windows Hello for Business, via Conditional Access policies. These methods are inherently resistant to AitM attacks because they require a physical presence and a cryptographic handshake that cannot be easily proxied.
2. Restrict Device-Code Flows: Many enterprises do not require device-code authentication for standard users. Security teams should consider disabling this flow at the tenant level where possible, or strictly limiting it to authorized devices and managed applications.
3. Anomalous Activity Monitoring: Organizations must enhance their logging and monitoring for "impossible travel" scenarios and anomalous sign-ins from unmanaged devices. Furthermore, any sudden registration of a new authentication method—especially one linked to a personal phone number or external authenticator app—should trigger an immediate, high-priority investigation.
4. User Education: Technical controls must be augmented with rigorous security awareness training. Employees should be instructed that legitimate IT departments will never ask for a user to input a code on an external site, nor will they initiate a request for passkey "updates" via SMS or unsolicited phone calls.

Conclusion: The Human Perimeter

The 2026 passkey phishing campaign underscores that the "perimeter" in modern cloud environments is identity-based. When the identity is compromised, the physical location of the user and the location of the data become secondary concerns. As threat actors like Storm-3121 and Storm-3032 continue to refine their methods, the burden of security falls equally on the robustness of the authentication architecture and the vigilance of the end-user.

While the industry continues to move toward a passwordless future, the transition period remains fraught with risk. By understanding that these attacks exploit the trust inherent in the IT-employee relationship, organizations can better prepare to intercept these campaigns before they escalate from a single compromised identity into a full-scale enterprise data breach. As always, a layered security posture—combining strict technical enforcement with proactive, transparent communication—remains the most effective defense against the evolving tactics of modern extortion groups.