Microsoft discloses M365 passkey phishing: fake IT helpdesk lures users to register attacker authenticators and hijack cloud accounts
Microsoft on 13 Sep disclosed an active Microsoft 365 campaign: since May 2026, attackers impersonate internal IT helpdesks via phone and SMS, lure employees to re-register passkeys or MFA on fake login pages, then enroll their own auth methods for persistence and exfiltrate cloud data at speed via Graph API.
Microsoft Threat Intelligence on 13 Sep 2026 disclosed two active campaigns. One targets Microsoft 365 and Microsoft Entra ID: since May 2026, attackers impersonate internal IT helpdesks, use phone calls and SMS to lure employees to "re-register passkeys, MFA, or SSO" on fake login pages, then enroll their own authentication methods on the victim account for persistence, and pull SharePoint Online, OneDrive for Business, and Exchange Online data at high speed via Microsoft Graph API.
Incident overview
The passkey phishing campaign involves two tracked clusters, Storm-3121 and Storm-3032, linked to the ShinyHunters/Falcon and Helix (formerly BlackFile) ransomware brands respectively.
Technical details
The passkey phishing chain is short. No malware.
Recon and contact
Attackers harvest employee names, titles, reporting lines, and internal IT helpdesk names from social networks and professional profile sites so calls can name the target's manager and department. Contact is the employee's personal mobile number, bypassing enterprise email gateways and managed devices, so no enterprise-side logs. Script: access is about to expire; passkey or MFA config must be updated immediately.
Fake login pages and AiTM proxy
SMS links point to sites mimicking the Microsoft login experience. Domains borrow identity-management language and embed the target company name in the subdomain for credibility. Disclosed lure domains include `passkeyhelpdesk[.]com`, `secure-passkey[.]com`, `setupmypasskey[.]com`, `add-passkey[.]com`, `oktasession[.]com`, and others. Pages either proxy the real login flow via adversary-in-the-middle (AiTM) or read out a device code for the user to enter, obtaining tokens without the password.
Enrolling attacker auth methods and exfil
Attackers then enroll their own authentication methods on the account (phone number, authenticator app, or software OTP). The point: these survive password resets. With access, they use Graph and REST APIs at machine speed to enumerate users, groups, and permissions, and bulk-download SharePoint and OneDrive content. Cloud access logs show a `python-httpx` user-agent. Auth, recon, and data theft use different IPs.
Impact
The crypto of passkeys is not what failed. Registration and recovery paths are. Passkeys are domain-bound and cannot complete authentication on a fake domain, so attackers skip that dead end and attack the "new device" enrollment flow. Organizations rolling passkeys out org-wide face amplified risk: users cannot tell a real registration notice from a phishing lure.
Remediation
- No patch. This is a config and process problem. First action: block device code flow with Conditional Access.
- Tighten who can register authentication methods. Block standard users from adding authenticators themselves. Require new auth-method enrollment only on already-trusted devices.
- Treat "IT calling about passkeys" as a verification event: hang up and call back the internally published official number. Do not use a callback number supplied by the caller.
- Block the lure domains above on email gateways and web proxies. Also watch `service-nowinc[.]com`, `domainlify[.]net`, and similar scam domains.
- Alerts: new authentication method registered shortly after a suspicious sign-in; high-frequency Graph activity that does not match the user's baseline.
Sources
- Provintell: Passkey-Themed Phishing Campaign Targets Microsoft 365
- Rescana: Passkey Phishing Attacks Target Microsoft 365 and Entra ID
- Check Point Research: 14th September Threat Intelligence Report