Passkey-Themed Phishing Attacks Target Microsoft 365

Microsoft has confirmed that threat actors linked to the ShinyHunters and Helix extortion gangs are conducting sophisticated passkey-themed phishing campaigns that compromise corporate Microsoft 365 accounts and steal sensitive data. The attacks, observed since May 2026, use social engineering tactics that impersonate IT help desks to manipulate employees into surrendering credentials.

These campaigns mark a concerning evolution in phishing techniques. Threat actors now exploit the growing adoption of passkeys by using them as a social engineering lure rather than a technical target. Consequently, organizations relying on passkey and single sign-on (SSO) deployments must strengthen their employee awareness programs.

What Happened: Passkey-Themed Phishing Attacks Target Corporate Microsoft 365 Accounts

Microsoft has linked multiple threat actors to an ongoing campaign that uses passkey, multi-factor authentication, and SSO-themed lures to trick employees into compromising their accounts. The activity has been tracked since May 2026 and involves careful pre-attack reconnaissance.

Threat actors research target organizations and employees through public sources before initiating contact. They impersonate corporate IT help desks through phone calls or messages. The attackers then claim that employees must urgently update their passkey, MFA, or SSO configuration to avoid losing access to corporate systems.

Victims are directed to phishing sites that closely mimic legitimate Microsoft login pages. Attackers sometimes send links through SMS messages to employees’ personal phones. Microsoft attributes this activity to Storm-3121, which is associated with ShinyHunters and Falcon extortion, and Storm-3032, believed to be tied to Helix and BlackFile extortion gangs.

Technical Details of the Passkey Phishing Campaign

The passkey-themed phishing attacks rely on adversary-in-the-middle (AiTM) infrastructure and device-code authentication flows rather than technical exploits of passkey implementations.

Attack Infrastructure and Lures

The attackers register convincing phishing domains that combine company names with passkey-related terminology. Microsoft has observed domains such as passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, add-passkey[.]com, integratedsso[.]com, oktasession[.]com, keysyncos[.]com, and oskeysync[.]com.

Attackers commonly place the victim company’s name in a subdomain. For example, they might use company-name.secure-passkey[.]com to make the portal appear more legitimate. This technique increases the likelihood that employees will trust the site and enter their credentials.

Credential Harvesting Methods

The campaigns use two primary methods to capture credentials:

1. Adversary-in-the-Middle (AiTM) attacks: The phishing sites act as a proxy between the victim and the real Microsoft login page. This allows the attacker to capture both credentials and session tokens in real time.
2. Device-code phishing: The attacker convinces the victim to enter a supplied code into Microsoft’s legitimate authentication page. This issues an authentication token to an attacker-controlled OAuth application, granting access without requiring another MFA challenge.

After gaining access, the attackers establish persistence by adding MFA methods they control. Microsoft observed threat actors registering new phone numbers, authenticator applications, and software-based one-time password tokens with compromised identities.

Post-Compromise Reconnaissance and Data Theft

Once inside, the attackers use Microsoft Graph API to systematically map the victim’s cloud environment. Microsoft observed Graph requests that enumerate organizations, users, groups, directory roles, registered authentication methods, applications, OAuth permissions, SharePoint sites, OneDrive resources, and mail folders.

Attackers then move into high-volume data collection from Microsoft SharePoint Online and Microsoft OneDrive for Business. Some intrusions extend into Microsoft Exchange Online through REST API-based access to email content. Microsoft noted that the exfiltration appears automated and uses the python-httpx user agent during SharePoint and OneDrive access.

Importantly, the attackers avoid rapid smash-and-grab exfiltration to evade detection. Instead, data theft lasts from a few hours to multiple days, with threat actors accessing fewer than 1,000 files or emails per hour to blend in with legitimate traffic.

Business and Operational Impact

The passkey-themed phishing campaigns pose significant risks to organizations across all sectors. The impact extends beyond immediate data theft to long-term operational and reputational damage.

• Data exposure: Attackers systematically exfiltrate sensitive documents, emails, and attachments from SharePoint, OneDrive, and Exchange Online.
• Identity compromise: The addition of attacker-controlled MFA methods creates persistent access that survives credential resets unless properly remediated.
• Supply chain risk: Compromised accounts can be used to access connected SSO applications, including Salesforce, Google Workspace, Dropbox, Adobe, SAP, Slack, Zendesk, and Atlassian.
• Extortion: The threat actors involved include ShinyHunters and Helix, both known for data theft and extortion operations.
• Reputational damage: Public disclosure of successful phishing campaigns can erode customer trust in an organization’s security posture.

Mitigation and Recommendations

Organizations must take immediate steps to defend against passkey-themed phishing campaigns. Microsoft has published specific guidance for detection and response.

Immediate Actions for Defenders

1. Deploy phishing-resistant MFA methods such as FIDO2 security keys or certificate-based authentication.
2. Limit sensitive cloud resources to managed devices through conditional access policies.
3. Disable device-code authentication when it is not needed in the environment.
4. Monitor for unusual sign-ins followed by new MFA registrations on existing accounts.
5. Alert employees to this specific campaign and instruct them to verify IT requests through established channels.

Detection Guidance

Microsoft recommends looking for the following indicators of compromise:

• Unusual sign-ins from unmanaged devices to Microsoft 365 services.
• New MFA registrations, especially phone numbers or authenticator apps added shortly after suspicious sign-ins.
• Rapid Microsoft Graph reconnaissance across users, groups, sites, and files.
• High-volume access to SharePoint Online, OneDrive for Business, or Exchange Online using the python-httpx user agent.
• Suspicious OAuth applications granted permissions through device-code flows.

Incident Response Steps

If an account is compromised, administrators should take the following actions:

1. Revoke all active sessions and tokens for the affected account.
2. Reset credentials and remove any authentication methods added by the attacker.
3. Remove any mailbox rules or forwarding configurations created by the threat actor.
4. Require the user to re-register their authentication methods from a trusted device.
5. Review audit logs for additional compromised accounts and lateral movement.

Bottom line: Passkey-themed phishing is a social engineering evolution, not a passkey vulnerability. Organizations must train employees to verify IT requests through established channels and deploy phishing-resistant MFA to reduce exposure.

Incident Summary

Incident Type:	Passkey-themed phishing and social engineering
Threat Actors:	Storm-3121 (ShinyHunters, Falcon), Storm-3032 (Helix, BlackFile)
Affected Services:	Microsoft 365, SharePoint Online, OneDrive for Business, Exchange Online
Disclosure Date:	September 11, 2026
Active Since:	May 2026
Primary Attack Vector:	Adversary-in-the-middle phishing and device-code authentication flows
Patch Status:	N/A (social engineering, not a software vulnerability)

References

1. Lawrence Abrams, “Passkey-themed phishing attacks lead to Microsoft 365 data theft,” BleepingComputer, September 11, 2026, https://www.bleepingcomputer.com/news/security/passkey-themed-phishing-attacks-lead-to-microsoft-365-data-theft/, accessed September 13, 2026.
2. Microsoft Threat Intelligence, “Passkey and SSO-themed social engineering leads to cloud account compromise,” Microsoft Security Blog, September 11, 2026.
3. BleepingComputer, “Hackers target Microsoft Entra accounts in device-code vishing attacks,” BleepingComputer, July 2026, https://www.bleepingcomputer.com/news/security/hackers-target-microsoft-entra-accounts-in-device-code-vishing-attacks/, accessed September 13, 2026.
4. BleepingComputer, “Hedge fund cyberattacks tied to BlackFile-linked UNC6671 extortion group,” BleepingComputer, August 2026, https://www.bleepingcomputer.com/news/security/hedge-fund-cyberattacks-tied-to-blackfile-linked-unc6671-extortion-group/, accessed September 13, 2026.