Researchers Warn: Passkey Phishing Attacks Are Leading to Cloud Account Takeovers

The landscape of enterprise cybersecurity is undergoing a precarious shift as threat actors pivot from brute-force tactics toward sophisticated social engineering campaigns that weaponize the very security protocols intended to protect users. Microsoft Security Research has issued an urgent advisory regarding an active, multi-layered campaign that leverages the confusion surrounding passkey implementation to bypass traditional identity protections. Since May 2026, threat actors have been impersonating IT help desk personnel, convincing employees to engage with fraudulent portals under the guise of mandatory security updates. This campaign does not represent a failure of passkey technology itself; rather, it highlights a critical vulnerability in the human element of corporate defense.

The Anatomy of the Deception

The attack vector typically begins with a high-pressure communication sent to an employee’s personal mobile device—a departure from traditional corporate email phishing. By initiating contact via SMS or direct messaging, often through platforms like Microsoft Teams, the attackers exploit the immediacy and perceived intimacy of personal communication channels. These adversaries pose as internal IT staff, warning the target that their multifactor authentication (MFA) or single sign-on (SSO) configurations are deprecated or failing.

The urgency is key to the deception. By claiming that a "passkey update" is required to prevent immediate loss of access to corporate resources, the attackers manipulate the victim into complying with instructions. The target is then directed to a pixel-perfect replica of a legitimate Microsoft sign-in page. It is here that the nature of the attack reveals itself: the passkey request is merely a distraction. Once the victim is on the fraudulent site, the attackers deploy Adversary-in-the-Middle (AiTM) techniques or device-code authentication. In an AiTM scenario, the attacker intercepts the session in real-time, capturing not just credentials, but the session tokens that allow them to bypass further authentication checks. Device-code phishing, conversely, tricks the user into entering a code that grants the attacker’s client application access to the user’s corporate environment.

Chronology of an Evolving Threat

The intelligence gathered by Microsoft indicates that this specific campaign has been operational since May 2026. While the methods have evolved, the underlying strategy remains consistent: establish trust through impersonation, create a sense of urgency through technical pretext, and extract a foothold into the cloud environment.

Throughout the summer of 2026, researchers observed a spike in anomalous sign-in activity. In documented incidents, once an attacker successfully bypassed the primary sign-in, they moved rapidly to consolidate their access. Within minutes of the initial compromise, these actors began registering their own persistent authentication methods—including malicious phone numbers, rogue authenticator apps, and software-based one-time password (OTP) tokens. By embedding these methods into the victim’s account profile, the attackers ensured they could maintain access even if the user realized their error and changed their password.

By the time an organization’s security operations center (SOC) might typically flag a standard credential reset, these attackers have already transitioned to the reconnaissance phase. Utilizing the Microsoft Graph API, they perform automated enumeration of the tenant’s structure, mapping out users, security groups, application permissions, and sensitive data locations across SharePoint and OneDrive.

The Role of Sophisticated Threat Actors

Microsoft has attributed the initial access and reconnaissance phases of this campaign to known threat clusters, specifically Storm-3121 and Storm-3032. The involvement of these groups underscores the professionalization of the identity-theft ecosystem. Storm-3121 has been historically linked to initial access brokering that paves the way for extortion groups like ShinyHunters and the Falcon extortion team. Storm-3032, a splinter group originating from the BlackFile collective and now operating under the Helix banner, represents a highly organized effort to monetize unauthorized cloud access.

The presence of these groups suggests that this is not a random nuisance, but a coordinated effort to extract high-value intellectual property, sensitive financial documents, and strategic corporate communications. The persistence of these sessions, which in some cases have lasted for an hour or more, allows the attackers to filter through massive datasets, identifying the most valuable targets for exfiltration or ransomware deployment.

Broader Implications for Cloud Security

The rise of passkey-themed phishing presents a unique challenge to the "Zero Trust" architecture that many enterprises have spent years implementing. While FIDO2-based passkeys are technically robust, the human tendency to trust "official" communications from an IT help desk creates a "backdoor" that technology alone cannot fully seal.

Data from the cybersecurity industry suggests that identity-based attacks are currently the most successful method for breaching cloud environments. As organizations migrate more of their workflows to cloud-native platforms like Microsoft 365, the identity of the user becomes the new perimeter. If that identity is compromised through a manipulated authentication flow, the entire perimeter is effectively dissolved. The use of the Microsoft Graph API is particularly concerning; it allows attackers to move laterally through an environment with the same permissions as the compromised user, effectively turning the victim’s own tools against them.

Mitigating the Risk: A Defensive Strategy

To counter this evolving threat, Microsoft and independent security analysts are calling for a multi-pronged defensive posture. The primary recommendation remains the universal enforcement of phishing-resistant MFA. While the attackers are using the concept of a passkey as a lure, they cannot easily bypass a legitimate, hardware-backed FIDO2 passkey that is tied to a specific device and domain.

Beyond technical requirements, organizations must refine their conditional access policies. This includes:

1. Restricting Device-Code Flows: Many organizations do not require the use of device-code authentication for standard web-based logins. Disabling this functionality for end-users can eliminate one of the primary methods attackers use to trick victims into authorizing malicious sessions.
2. Behavioral Analytics: SOC teams should configure alerts specifically for the registration of new, unusual authentication methods. Any addition of a new authenticator app or phone number should trigger an immediate, high-priority review.
3. Graph Activity Monitoring: Organizations should monitor for high-volume or unusual calls to the Microsoft Graph API, especially those originating from IP addresses or user agents that do not align with typical company device profiles.
4. Employee Education: The most effective defense is a well-informed workforce. Training programs must be updated to emphasize that legitimate IT departments will never ask an employee to provide an authentication code or follow an external link to "set up" or "reset" a passkey.

Conclusion: The Human-Technology Interface

The ongoing campaign serves as a sobering reminder that as security technology improves, adversaries will shift their focus to the weakest link in the chain: the user. By impersonating the very systems that employees rely on for security, attackers have found a way to turn the user’s diligence into a liability.

The security industry faces a significant hurdle in the coming months as companies transition toward passwordless authentication. If organizations do not communicate the transition process clearly, they will continue to provide the cover that actors like Storm-3121 and Storm-3032 need to operate. The goal for enterprises is to ensure that the transition to more secure authentication methods like passkeys is handled through formal, verified channels, stripping away the ambiguity that currently allows these social engineering campaigns to thrive. Until then, the cloud remains a high-value target for those who can successfully navigate the gap between technical security and human trust.