Passkey phishing opens M365 data theft playbook

Attackers are calling and texting employees with a story about a passkey that needs immediate attention, then walking them into phishing pages built to look like Microsoft sign-ins. Microsoft says the intrusions tied to this campaign have been observed since May 2026 and have resulted in theft from Microsoft 365 services.

The lures are not trying to enroll a passkey at all. According to Microsoft, the passkey story is a way to push employees toward adversary-in-the-middle phishing sites or device-code authentication flows, where credentials and session tokens can be captured.

Calls that impersonate IT help desks

Microsoft describes an opening phase built on research rather than volume. The threat actors look into the targeted organization and its employees before making contact, then call or message victims while pretending to be a corporate IT help desk.

The story delivered to employees is urgent: a passkey, multi-factor authentication setting, or single sign-on configuration reportedly needs to be updated right away or access to corporate systems will be lost. From there, victims are directed to phishing sites made to resemble legitimate Microsoft login pages. Microsoft says links are sometimes sent by SMS to employees' personal phones, moving the lure off corporate channels.

The research phase is deliberate enough that Microsoft called it out directly.

"The actor appears to invest heavily in pre-attack research, likely gathering information about employees and organizational structure from public sources such as social networking and professional profiling platforms," explains Microsoft.

— Microsoft

Domains built on passkey keywords

The infrastructure follows the same theme as the phone calls. Microsoft says the attackers register phishing domains that combine company names with words tied to passkeys, SSO, key synchronization, account setup, and identity verification.

Examples Microsoft listed include passkeyhelpdesk[.]com, secure-passkey[.]com, setupmypasskey[.]com, add-passkey[.]com, integratedsso[.]com, oktasession[.]com, keysyncos[.]com, and oskeysync[.]com.

To make a phishing portal more convincing, Microsoft says the attackers commonly place the victim company's name in a subdomain, as in company-name.secure-passkey[.]com.

An ecosystem, not a single crew

Microsoft attributes the initial-access activity to several threat actors working inside the same extortion ecosystem. The company tracks them as Storm-3121 and Storm-3032.

Storm-3121 is associated with ShinyHunters and Falcon extortion, according to Microsoft. Storm-3032 is believed to be tied to BlackFile extortion group members now operating under the Helix name. The activity overlaps with attacks previously documented by Google Threat Intelligence under the UNC6671 threat cluster. Google has reported that UNC6671 uses phone-based social engineering and passkey-themed phishing infrastructure to compromise corporate identities before reaching enterprise cloud environments, and has linked that activity to the same extortion gangs, including BlackFile, Helix, Falcon, Pink, and Redact.

Inside the hour after sign-in

Microsoft also described what happens after an account falls. In one investigated attack, a suspicious sign-in came from an unmanaged device to a Microsoft 365 service identified in Entra logs as "OfficeHome", which is associated with the Office 365 portal's shared infrastructure, including Office applications accessed through a browser.

After completing MFA, the attacker established a valid session and started checking what the compromised account could reach. Within minutes, that session was used to visit My Apps to see assigned applications, My Profile for organizational information, Microsoft Approval Management, account-management interfaces, and My Sign-Ins.

The attacker then moved to SharePoint Online, Outlook Web, Microsoft 365 collaboration and search services, an internal business application, and authentication flows associated with virtual desktops. Microsoft says the session stayed active for approximately one hour while the attacker listed sensitive files and internal applications.

Device codes hand over a token

A second attack pattern ran through device-code phishing. The victim was convinced to enter a code supplied by the attacker into Microsoft's legitimate authentication page. That issues an authentication token to an attacker-controlled OAuth application, letting the threat actor reach the account without completing another MFA challenge.

From that position, Microsoft says the attacker can reach all of the user's resources and connected SSO applications, including Microsoft 365, Salesforce, Google Workspace, Dropbox, Adobe, SAP, Slack, Zendesk, and Atlassian, among others.

A third attack involved previously compromised credentials for an account where an authenticator application is believed to have been registered days earlier. Microsoft says the threat actors then performed reconnaissance with an automated Node.js system and Microsoft Graph.

Persistence by adding a second factor

Once inside, the attackers often try to keep the door open. Microsoft says they register new phone numbers, authenticator applications, and software-based one-time password tokens with compromised identities.

That lets the threat actor satisfy future MFA challenges without the victim's help. Microsoft notes one limit on the technique: the persistence does not survive a complete credential and session reset.

Before collecting data, the attackers use Microsoft Graph to map the victim's cloud environment. Microsoft observed Graph requests enumerating:

• Organizations, licenses, and enabled services
• Users, groups, and group membership
• Directory roles and privileged accounts
• Registered authentication methods
• Applications and service principals
• OAuth permissions and application role assignments
• SharePoint sites, document libraries, folders, and files
• OneDrive resources
• Mail folders, messages, and attachments

Requests such as /users, /groups, or /sites are common in enterprise environments, Microsoft says, so they may not raise alarms on their own. The activity turns more suspicious when the same account, application, or access token rapidly moves across different resources, checks privileges and authentication settings, and then begins reaching email, attachments, files, or documents.

Slow downloads to stay under the radar

The collection phase centers on Microsoft 365 data. Microsoft described high-volume access and download activity aimed at Microsoft SharePoint Online and Microsoft OneDrive for Business, with some intrusions extending into Microsoft Exchange Online through REST API-based access to email content.

"Across SharePoint and OneDrive, the activity generated significant volumes of FileAccessed and FileDownloaded events, indicating systematic retrieval of cloud-hosted documents and organizational data," explained Microsoft.

— Microsoft

The low-and-slow pattern is part of the design. Microsoft says the activity appears automated, with connections using the python-httpx user agent during SharePoint and OneDrive access exfiltration. Rather than a rapid smash-and-grab, the theft lasts from a few hours to multiple days, with threat actors accessing fewer than 1,000 files or emails in a single hour to blend in with legitimate traffic.

What defenders should look for

Microsoft recommends watching for unusual sign-ins followed by new MFA registrations, Microsoft Graph reconnaissance, and suspicious access to SharePoint, OneDrive, or Exchange.

If an account is compromised, the company's guidance is to revoke active sessions and tokens, reset credentials, remove any authentication methods or mailbox rules added by the attackers, and require the user to re-register their authentication methods.

Microsoft also recommends using phishing-resistant MFA, limiting sensitive cloud resources to managed devices, and disabling device-code authentication when it is not needed — a step aimed squarely at the flow abused in one of the attack patterns. For teams planning larger defensive changes, Microsoft is promoting a two-hour digital summit with Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian, framed around building a security blueprint for AI-powered attacks.

Why the passkey angle matters

The campaign's central trick is misdirection. Passkeys are often described as a stronger alternative to passwords, and a help-desk call about one sounds like a routine identity task rather than a security incident. Microsoft's finding that the attackers are not actually enrolling a passkey suggests the value is in the story, not the technology — it gives an attacker a plausible reason to rush an employee onto a page they control.

For organizations, the details Microsoft published point to a few practical areas of exposure. Phone-based contact that reaches personal devices sits outside many corporate monitoring tools, and a session that can list files and internal applications for roughly an hour before anything obvious happens leaves a narrow window for detection. The persistence step — registering a new phone number, authenticator app, or software token — means that even after an initial compromise, an account can be re-entered unless credentials and sessions are fully reset.

The Graph reconnaissance list is also a reminder that routine API calls can be legitimate and malicious at the same time. Whether the pattern involves Microsoft 365, Salesforce, Google Workspace, Dropbox, Adobe, SAP, Slack, Zendesk, or Atlassian, the token obtained in a device-code flow can travel beyond Microsoft's cloud. That suggests the same social engineering play could reach accounts and data in whatever connected services an organization relies on, not only the ones named in the phishing page.

Because the activity is reported by Microsoft and overlaps with prior Google Threat Intelligence findings on UNC6671, the broad shape of the extortion ecosystem appears to be shared across vendors. The specifics of any single intrusion still depend on the source — Microsoft's account of the attacks — and there is no independent corroboration of individual victims at this point. What is clear from the published guidance is that the defensive checklist is not exotic: phishing-resistant MFA, tighter restrictions on sensitive resources, and turning off device-code authentication where it isn't needed.