Sophisticated Identity Compromise: How Passkey-Themed Phishing Exploits Microsoft 365 Environments

A new wave of advanced social engineering campaigns, leveraging themes around passkeys and single sign-on, is enabling notorious cybercriminal syndicates to breach corporate Microsoft 365 accounts and exfiltrate sensitive data. These meticulously planned attacks, observed since early 2026, represent a significant evolution in phishing tactics, moving beyond simple credential theft to sophisticated adversary-in-the-middle (AiTM) and device-code authentication abuses, ultimately leading to deep incursions into enterprise cloud infrastructure.

The digital landscape is increasingly fraught with sophisticated threats, where cybercriminals continually adapt their methodologies to circumvent established security measures. Identity-based attacks, in particular, have emerged as a primary vector, targeting the very foundation of modern enterprise security: user credentials and authentication mechanisms. Microsoft 365, as a ubiquitous platform for business operations, collaboration, and data storage, naturally presents a high-value target. Its widespread adoption means that a successful compromise can yield access to an organization’s most critical assets, ranging from proprietary documents and financial records to intellectual property and customer data. The current threat landscape demonstrates a strategic shift by attackers, focusing on compromising user identities as the gateway to broader network penetration and data exfiltration.

Pre-Attack Reconnaissance and Tailored Social Engineering

The efficacy of these campaigns hinges on extensive preparatory reconnaissance. Threat actors meticulously research their target organizations and specific employees, gathering intelligence from publicly accessible sources such as professional networking sites and corporate profiles. This pre-attack intelligence gathering allows them to craft highly convincing social engineering lures. The initial engagement often takes the form of voice calls or messages, where attackers impersonate internal IT support personnel. This impersonation leverages inherent trust within an organization, making the victim more susceptible to believing the fabricated narrative.

The core of the social engineering ploy revolves around an urgent request for the employee to update a critical security configuration, typically framed as a "passkey," multi-factor authentication (MFA), or single sign-on (SSO) setting. The manufactured urgency is a key psychological manipulation tactic, designed to bypass critical thinking and induce immediate action, often under the guise of preventing service disruption or account lockout. While the lures frequently mention "passkeys," the actual objective is not to enroll a passkey for the attacker. Instead, these references serve as a highly effective pretext to direct victims toward malicious authentication portals or to coerce them into unknowingly authorizing attacker-controlled applications.

Advanced Phishing Mechanisms: AiTM and Device-Code Abuse

Victims are subsequently steered towards meticulously crafted phishing websites designed to mimic legitimate Microsoft login pages. The links to these fraudulent sites are often delivered via SMS messages to employees’ personal mobile devices, further blurring the lines between corporate and personal communication channels and bypassing some organizational email security controls.

Two primary technical mechanisms underpin these advanced phishing attacks:

1. Adversary-in-the-Middle (AiTM) Phishing: In an AiTM attack, the phishing site acts as a proxy, sitting between the victim and the legitimate Microsoft authentication service. When the victim enters their credentials and completes any MFA challenges on the phishing site, the AiTM server intercepts these inputs and forwards them in real-time to Microsoft’s actual login page. Simultaneously, it captures the legitimate session tokens returned by Microsoft. This allows the threat actor to gain immediate, authenticated access to the victim’s account without possessing the actual password or needing to re-authenticate with MFA. The victim, unaware of the interception, believes they have successfully logged in, while the attacker gains a valid, active session.

   

2. Device-Code Authentication Flow Abuse: This technique exploits a legitimate authentication method designed for devices without direct web browser access. Victims are directed to a legitimate Microsoft authentication page and prompted to enter a specific code. The attacker provides this code, which is secretly linked to an attacker-controlled OAuth application. By entering the code, the victim unwittingly authorizes this malicious application to access their account. This grants the threat actor a persistent authentication token, allowing them to bypass future MFA challenges and access all resources associated with the user’s identity, including Microsoft 365 services, as well as integrated third-party applications like Salesforce, Google Workspace, Dropbox, and SAP.

To enhance the credibility of their phishing infrastructure, threat actors register domain names that cleverly combine legitimate company names with security-related keywords such as "passkey," "SSO," "key synchronization," "account setup," and "identity verification." Examples observed include passkeyhelpdesk[.]com, secure-passkey[.]com, and integratedsso[.]com. Furthermore, they frequently embed the target company’s name within a subdomain (e.g., company-name.secure-passkey[.]com), creating a highly deceptive appearance that makes the phishing portal virtually indistinguishable from a legitimate corporate gateway to an unsuspecting user.

Attribution to a Coordinated Extortion Ecosystem

Microsoft attributes the initial access stages of these campaigns to multiple interconnected threat actors operating within a broader extortion ecosystem. Specifically, groups tracked as Storm-3121 and Storm-3032 have been identified. Storm-3121 is closely associated with the notorious ShinyHunters data extortion group and the Falcon extortion syndicate. Storm-3032, on the other hand, is believed to comprise members of the BlackFile extortion group who are now operating under the moniker Helix.

This activity aligns significantly with prior intelligence from Google Threat Intelligence, which documented attacks by a cluster identified as UNC6671. Google’s reports indicated that UNC6671 similarly employs phone-based social engineering and passkey-themed phishing infrastructure to compromise corporate identities, subsequently gaining access to enterprise cloud environments. Google has also established linkages between UNC6671 and the same consortium of extortion gangs, including BlackFile, Helix, Falcon, Pink, and Redact, underscoring a coordinated effort among these criminal enterprises. This interconnectedness highlights a shared playbook and infrastructure, indicating a mature and collaborative cybercriminal landscape.

Post-Compromise Activities: Mapping and Exfiltration

Upon successful account compromise, threat actors systematically escalate their access and exfiltrate data. Microsoft’s deep forensic analysis provides crucial insights into these post-compromise behaviors within Microsoft cloud environments.

In one investigated incident, a suspicious sign-in from an unmanaged device to a Microsoft 365 service, identified in Entra logs as "OfficeHome," marked the initial breach. "OfficeHome" is associated with the shared infrastructure of the Office 365 portal, encompassing browser-based access to Office applications. After successfully completing the MFA challenge (often facilitated by AiTM), the attacker established a valid session and immediately began a reconnaissance phase. Within minutes, the compromised session was used to access "My Apps" to enumerate applications assigned to the account, "My Profile" for organizational information, "Microsoft Approval Management," account-management interfaces, and "My Sign-Ins." This rapid initial mapping allows the attacker to understand the scope of the compromised identity’s permissions and identify potential avenues for lateral movement or data access. The attacker then proceeded to access SharePoint Online, Outlook Web, Microsoft 365 collaboration and search services, an internal business application, and authentication flows linked to virtual desktops. This session remained active for approximately one hour, during which the attacker systematically listed sensitive files and internal applications, meticulously preparing for data exfiltration.

To maintain persistent access, threat actors frequently register new MFA methods under their control. This includes adding new phone numbers, authenticator applications, or software-based one-time password (OTP) tokens to the compromised identity. This critical step ensures that they can satisfy future MFA challenges independently, even if the victim changes their password, thereby circumventing one of the primary protective measures against account reuse. While this persistence mechanism is robust, Microsoft notes that it can be mitigated by a complete credential and session reset, coupled with a mandatory re-registration of all authentication methods by the legitimate user.

Systematic Cloud Environment Enumeration via Microsoft Graph

A critical phase post-compromise involves comprehensive reconnaissance of the victim’s cloud environment, often executed using automated Node.js systems and Microsoft Graph. Microsoft Graph is a powerful unified API endpoint that allows programmatic access to data and intelligence across Microsoft 365, Windows, and Enterprise Mobility + Security. For attackers, it’s an invaluable tool for enumerating the cloud environment with precision.

Microsoft observed attackers making Graph API requests to enumerate:

• Users: Listing all users within the tenant, their attributes, and roles.
• Groups: Identifying security groups, distribution lists, and their members.
• Sites: Discovering SharePoint sites, their content, and permissions.
• Mailboxes: Accessing information about email accounts.
• Files: Locating documents and data stored in OneDrive and SharePoint.
• Applications: Identifying registered applications and their permissions.
• Tenant Settings: Understanding global configurations and policies.

While Graph requests for /users, /groups, or /sites are common in legitimate enterprise environments and might not immediately trigger alerts, the suspicious nature arises when the same account, application, or access token rapidly moves across disparate resources, repeatedly checks privileges and authentication settings, and then initiates access to email, attachments, files, or documents. This pattern of behavior is a strong indicator of malicious activity.

Stealthy Data Exfiltration and Mitigation Strategies

Following reconnaissance, attackers pivot to systematic data collection from Microsoft 365 services. Microsoft observed high-volume access and download activity targeting Microsoft SharePoint Online and Microsoft OneDrive for Business. Some intrusions extended to Microsoft Exchange Online through REST API-based access to email content. This activity generates significant volumes of FileAccessed and FileDownloaded events, indicative of the systematic retrieval of cloud-hosted documents and organizational data. The exfiltration process often appears automated, with connections frequently originating from agents using the python-httpx user agent during SharePoint and OneDrive access.

Crucially, attackers have adopted strategies to evade detection, deliberately avoiding rapid "smash-and-grab" exfiltration techniques. Instead, data theft typically spans several hours to multiple days, with threat actors accessing fewer than 1,000 files or emails in a single hour. This "slow and low" approach is designed to blend in with legitimate user traffic, making it challenging for standard security monitoring solutions to flag the activity as anomalous.

To counter these evolving threats, Microsoft recommends several critical security measures:

• Phishing-Resistant MFA: Implement and enforce phishing-resistant MFA methods such as FIDO2 security keys or certificate-based authentication. These methods inherently resist AiTM attacks by binding authentication to a specific origin.
• Conditional Access Policies: Restrict access to sensitive cloud resources by enforcing conditional access policies that require managed devices, specific network locations, or compliant device states.
• Disable Unnecessary Features: Disable device-code authentication flows when they are not actively required for specific business functions to eliminate this vector of attack.
• Enhanced Monitoring and Alerting: Organizations should scrutinize unusual sign-ins, particularly those followed by new MFA registrations, patterns of rapid Microsoft Graph reconnaissance across diverse resources, and suspicious high-volume access to SharePoint, OneDrive, or Exchange. Advanced SIEM/SOAR solutions with behavioral analytics can be instrumental in detecting these subtle indicators.
• Robust Incident Response: In the event of an account compromise, immediate and comprehensive action is paramount. Administrators must revoke all active sessions and tokens, reset credentials, remove any authentication methods or mailbox rules added by the attackers, and mandate that the user re-register all their authentication methods from a known good state.
• Continuous User Education: Beyond technical controls, ongoing, sophisticated user education is vital. Employees must be trained to recognize advanced social engineering tactics, understand the risks of urgent requests for credential updates, and be aware of the legitimate processes for IT support and security configuration changes.

The ongoing evolution of these passkey-themed phishing attacks underscores the persistent and dynamic nature of cyber threats. By combining sophisticated social engineering with advanced technical exploits like AiTM and device-code phishing, and leveraging a coordinated criminal ecosystem, threat actors are effectively circumventing traditional security barriers. A multi-layered defense strategy, encompassing robust technical controls, continuous monitoring, and comprehensive user education, is essential for organizations to protect their identities and data in the face of these increasingly sophisticated assaults.